CVE-2026-81683: openssl_encrypt before 1.4.9 Plaintext Private Key Storage
opensslencrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encrypt (pip package openssl-encrypt)to a version that resolves this vulnerability.Fixed in 1.4.9 - Configuration
After upgrading to v1.4.9, ensure the client mTLS private key is not stored in cleartext in the 'combined certificate and private key' PEM field in Settings; it should be written to a dedicated 0600 file and only the file path should remain in SharedPreferences, with any prior cleartext SharedPreferences values migrated/scrubbed.
openssl_encrypt desktop GUI Settings screen combined certificate and private key PEM field storage = Store PEM in a dedicated 0600 file and keep only its path in SharedPreferences (migrate and scrub existing cleartext values)
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the desktop GUI of openssl_encrypt 1.4.8 or earlier are exposed if an mTLS client private key was entered through the Settings screen's combined certificate and private key PEM field. A local attacker with file system access can read the key from the world-readable SharedPreferences file.
What access does an attacker need to exploit it?
The attacker needs local file system access to the affected system. No authentication or user interaction is required to read the cleartext private key once the vulnerable SharedPreferences file is accessible.
How can I determine whether a system is affected?
Check whether openssl_encrypt is version 1.4.8 or earlier and whether the desktop GUI was used to configure a combined certificate and private key PEM value. On affected installations, that private key may be present in cleartext in a SharedPreferences file with 0644 permissions.
What should be done if a private key may have been exposed?
Upgrade to version 1.4.9, which stores the PEM in a dedicated 0600 file and migrates and scrubs existing cleartext SharedPreferences values. Treat any key stored under the vulnerable configuration as potentially disclosed and replace it as appropriate.