CVE-2026-81681: openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage
opensslencrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption key is never applied to it. A user who trusts the branding and places files in the workspace leaves them unencrypted on the removable media, so an attacker with physical access to the media can read the sensitive files. Fixed in 1.4.9, which seals the workspace into an authenticated AES-256-GCM vault.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encrypt (pip package openssl-encrypt)to a version that resolves this vulnerability.Fixed in 1.4.9
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of openssl-encrypt versions 1.4.8 and earlier who stored sensitive files in the portable USB workspace are exposed. The files remain readable in cleartext on the removable media despite the workspace being labeled as encrypted.
What does an attacker need to exploit it?
An attacker needs physical access to the removable media containing the workspace. No credentials or user interaction are required to read files stored in the affected workspace.
Are files protected by the workspace marker or advertised AES-256-GCM encryption?
No. In affected versions, the marker only declares that the workspace is encrypted; the directory is stored in cleartext, and the derived encryption key is never applied to it.
What should be done if affected media may already contain sensitive files?
Treat files previously placed in an affected workspace as exposed, because they may have been readable by anyone with physical access to the media. Upgrade to version 1.4.9, which seals the workspace into an authenticated AES-256-GCM vault.