CVE-2026-81701: openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin
opensslencrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.9 - Compensating control
Prevent loading unsigned plugins from the top-level plugins/ directory and from unknown subdirectories so that signature verification cannot be bypassed by directory placement.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Installations running openssl_encrypt before 1.4.9 are exposed if an attacker can place an unsigned plugin in a top-level plugins/ directory or an unknown subdirectory that follows documented plugin installation paths.
What does an attacker need to exploit it?
The attacker needs the ability to place a malicious unsigned plugin in an affected plugin location. No authentication or user interaction is indicated by the supplied severity vector.
What is the impact if exploitation succeeds?
A malicious plugin can achieve arbitrary code execution in the CLI process. That process may have access to passwords and cryptographic keys, and the reported impact includes high confidentiality, integrity, and availability consequences.
How can I determine whether my deployment is affected?
Check whether the installed openssl_encrypt version is earlier than 1.4.9, then inspect top-level plugins/ directories and unknown plugin subdirectories for unsigned plugins installed through documented plugin paths.