CVE-2026-81715: openssl_encrypt before 1.4.9 Credential Exposure via Debug Output
opensslencrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr under --debug (even without --unsafe-show-secrets), persisting the credential in logs and terminal history. Fixed in 1.4.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encrypt (pip package openssl-encrypt)to a version that resolves this vulnerability.Fixed in 1.4.9 - Operational
If the application was run with --debug on openssl_encrypt (openssl-encrypt) versions <= 1.4.8, review and remove the exposed keyserver bearer token from logs and terminal history entries created during the debug session.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the PyPI openssl-encrypt package version 1.4.8 or earlier are exposed when they run the keyserver set-token command with --debug enabled. The bearer token can then be written in cleartext to stderr.
Does exploitation require --unsafe-show-secrets?
No. The token is exposed in the debug argv dump even when --unsafe-show-secrets is not used.
What should be reviewed if an affected version was used?
Review stderr output, logs, and terminal history from --debug executions of keyserver set-token for exposed bearer tokens. Any token found in those locations should be treated as disclosed.
What is the available fix?
Upgrade openssl-encrypt to version 1.4.9, which fixes the missing redaction of the positional keyserver bearer token.