CVE-2026-81684: openssl_encrypt before 1.4.9 Information Disclosure via Command Line
In opensslencrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the --stego-password argument (on both encrypt and decrypt paths) instead of via an environment variable as done for the main password. Any local user can read the steganography password from /proc/<pid>/cmdline for the lifetime of the subprocess. Fixed in 1.4.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encrypt (pip package openssl-encrypt)to a version that resolves this vulnerability.Fixed in 1.4.9
Event History
Frequently Asked Questions
Who can obtain the exposed steganography password?
Any local user who can inspect /proc/<pid>/cmdline while the encryption or decryption CLI subprocess is running can read the password. Remote attackers are not described by the available information.
What conditions are required for exploitation?
The affected desktop GUI must invoke its CLI child process on an encrypt or decrypt path using a steganography password. The attacker needs local access and must read the child process command line during its lifetime; no privileges or user interaction are required.
How can I determine whether an installation is affected?
Installations of the PyPI package openssl-encrypt at version 1.4.8 or earlier are affected. During a GUI operation using steganography, the vulnerable behavior is the presence of --stego-password and its password value in the CLI subprocess command line.
What should be done if upgrading is not immediately possible?
Prevent untrusted local users from accessing the system or observing process command lines while the application performs steganography encryption or decryption. Avoid using the affected GUI steganography paths until upgrading to version 1.4.9 or later.