Loading...
Skip to main content
GeekWala

CVE-2026-81719 — Vulnerability in openssl-encrypt — CVE Details

CRITICAL

Published August 27, 2026Updated September 3, 2026Source: osv

Summary

openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The only default gate was an incomplete, bypassable AST denylist. If a user is induced to load an attacker's plugin, this results in arbitrary code execution with the privileges of the user running openssl_encrypt. Fixed in 1.4.9 by defaulting the signature policy to ENFORCE for non-built-in plugins.

Advisory Timeline

  • First published August 27, 2026 (46 days ago).
  • Last revised September 3, 2026 — 7 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

pip
Update openssl-encrypt to 1.4.9 or later
pip install "openssl-encrypt>=1.4.9"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: pypi (1).

PackageEcosystemAffectedFixed In
openssl-encrypt
pypi
0.2.2, 0.2.3, 0.2.4, 0.2.5 (+49 more)1.4.9

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Frequently Asked Questions

What is CVE-2026-81719?
This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2026-81719?
CVE-2026-81719 affects openssl-encrypt. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-81719 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

PYSEC-2026-3802
GHSA-587j-4r3v-cm2c

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies