CVE-2026-81689: openssl_encrypt before 1.4.9 Weak Pepper Key Derivation
opensslencrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offline password guessing at hardware speed to recover user passwords.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenSSL openssl_encrypt pepper blob remote-pepper wrap key derivationto a version that resolves this vulnerability.Fixed in 1.4.9 - Configuration
Ensure openssl_encrypt uses the post-1.4.9 key derivation so the remote-pepper wrap key is not derived from unsalted HKDF-SHA256 or bare SHA-256 of the password (which enables identical keys across users/files).
OpenSSL openssl_encrypt pepper key derivation for remote-pepper wrap key = use salted HKDF-SHA256 (not unsalted HKDF-SHA256 or bare SHA-256)
Event History
Frequently Asked Questions
Who is exposed to practical exploitation?
Deployments using openssl_encrypt versions before 1.4.9 are exposed if an attacker can obtain remote-pepper wrapped blobs. The issue enables offline password guessing without requiring prior authentication or user interaction.
What does an attacker need to exploit this weakness?
The attacker needs access to wrapped pepper blobs and a password dictionary or candidate passwords. Because the derivation is unsalted, a single precomputed dictionary table can be reused across users and files.
How can we determine whether we are affected?
Check whether the deployed openssl_encrypt version is earlier than 1.4.9. Also identify whether remote-pepper wrapped blobs may have been exposed or are accessible to untrusted parties.