CVE-2026-81705: openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug
openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2>&1 output, CI job logs, or the GUI's persistent debug log) can recover the password.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this leak?
Users of openssl-encrypt before 1.4.9 are exposed when they enable --debug and provide a file password using bundled short-option spellings such as -apHunter2 or abbreviated long-option spellings such as --passw. Anyone able to view the resulting stderr, including CI log readers and users with access to persistent GUI debug logs, can recover the password.
Does exploitation require access to the affected system or the ability to run the tool?
The password is written to stderr during the affected debug invocation. An attacker needs access to the generated output, such as terminal scrollback, merged 2>&1 output, CI job logs, or the GUI's persistent debug log; the advisory does not describe a need to execute the tool themselves.
What can be done if upgrading is not immediately possible?
Avoid using --debug when supplying file passwords, particularly with bundled short options or abbreviated long options. Treat existing debug output and logs from affected invocations as exposed, restrict access where possible, and change any passwords that may have been recorded.
How can I determine whether passwords may already have leaked?
Review terminal scrollback, redirected or merged stderr output, CI job logs, and persistent GUI debug logs for openssl-encrypt debug invocations before 1.4.9. Focus on runs where passwords were supplied using bundled short-option or abbreviated long-option spellings.