CVE-2026-81702: openssl_encrypt before 1.4.9 Key Substitution via Identity Load
opensslencrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.9
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using openssl_encrypt versions before 1.4.9 that load identities from identity.json are exposed. The issue affects identity stores where an attacker can replace a legitimate public key.
What access does an attacker need to exploit this?
An attacker needs the ability to modify public keys in an identity store or otherwise cause a malicious identity.json to be loaded. No authentication or user interaction is required by the vulnerability itself once the malicious identity is loaded.
How can this affect cryptographic operations?
An attacker can substitute their own public key while retaining the claimed fingerprint. Encryption may then use the attacker's key, and signature verification can appear valid despite the substituted key.
What is the available remediation version?
Upgrade to version 1.4.9 or later. Versions before 1.4.9 do not re-derive and validate fingerprints when identities are loaded from identity.json.