CVE-2026-81719: openssl_encrypt before 1.4.9 Remote Code Execution via Plugin
opensslencrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The only default gate was an incomplete, bypassable AST denylist. If a user is induced to load an attacker's plugin, this results in arbitrary code execution with the privileges of the user running opensslencrypt. Fixed in 1.4.9 by defaulting the signature policy to ENFORCE for non-built-in plugins.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.9 - Configuration
In openssl_encrypt v1.4.9, default the plugin signature policy to ENFORCE for non-built-in plugins so unsigned/unverifiable non-built-in plugins are not compiled/executed.
openssl_encrypt plugin signature policy = ENFORCE for non-built-in plugins - Compensating control
Ensure users cannot load attacker-controlled plugins (e.g., restrict or vet which non-built-in plugins are allowed to be installed/loaded), since inducing a user to load an attacker's plugin can lead to arbitrary code execution.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users running versions before 1.4.9 are exposed if they can be induced to load an attacker-controlled third-party plugin. Code runs with the privileges of the user running openssl_encrypt.
Are default settings affected?
Yes. Before 1.4.9, the default signature policy was WARN, which allowed unsigned or unverifiable non-built-in plugins to be compiled and executed. The remaining default AST denylist was incomplete and bypassable.
What changed in the fix?
Version 1.4.9 changes the default signature policy to ENFORCE for non-built-in plugins. This prevents the prior default behavior of accepting unsigned or unverifiable third-party plugins.