A critical flaw in the openssl_encrypt Python package reportedly lets attackers swap public keys inside identity stores without breaking the claimed fingerprint, silently redirecting encryption to attacker-controlled keys.
What Is It
According to the published advisories, openssl_encrypt before version 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json. Because the stored fingerprint is trusted rather than recomputed from the key material, an attacker who can modify an identity store can replace a legitimate public key with their own while the claimed fingerprint stays intact.
The advisories describe the result as silent key substitution: encryption operations use the attacker's key, and signature verification is said to still appear valid to the user. The issue is tracked as CWE-345 (Insufficient Verification of Data Authenticity) and was disclosed via VulnCheck.
Why It Matters
The CVE record carries a CNA-assigned CVSS 3.1 base score of 9.8 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low complexity, no privileges and no user interaction required, with high confidentiality, integrity, and availability impact. A secondary CVSS 4.0 score of 9.3 (CRITICAL) is also published in the record. These scores originate from the assigning CNA, not from NVD analysis, which has not yet been completed; NVD may publish different values once it analyzes the record.
The failure mode described by the advisories is the dangerous kind: no error, no warning, and no verification failure. Per those descriptions, data the user believes is encrypted to a trusted recipient is encrypted to the attacker, and forged signatures pass validation. This behavior is as characterized in the advisories and has not been independently verified here.
This CVE does not appear in the CISA KEV catalog in the supplied data; there is no confirmation of active exploitation and no associated federal remediation deadline.
What's Vulnerable
- Vendor: jahlives
- Product:
openssl_encrypt(pkg:pypi/openssl-encrypt) - Affected: all versions before 1.4.9
- Not affected: 1.4.9 and later
No CPE entries were published with the record at the time of writing.
Patch Status
Version 1.4.9 is listed as unaffected. Upgrading to 1.4.9 or later is the fix. The record carries a publication date of 2026-08-27 and remains in Received status, meaning NVD analysis is not yet complete and the enrichment data above may change.
Sources
- NVD CVE record (status: Received), https://nvd.nist.gov/vuln/detail/CVE-2026-81702
- GitHub Security Advisory (GHSA-q8p3-7h6h-ghfr), https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-q8p3-7h6h-ghfr
- VulnCheck Advisory; https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-key-substitution-via-identity-load