CVE-2026-81681: Missing Encryption of Sensitive Data in jahlives openssl_encrypt
Description
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption key is never applied to it. A user who trusts the branding and places files in the workspace leaves them unencrypted on the removable media, so an attacker with physical access to the media can read the sensitive files. Fixed in 1.4.9, which seals the workspace into an authenticated AES-256-GCM vault.
CVSS v4.0
Score 9.3critical
Affected software
jahlives
openssl_encrypt
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in openssl_encrypt (pip package) versions up to 1.4.8 involves a missing encryption step for the workspace directory. Although the package claims to use AES-256-GCM encryption and marks the workspace as encrypted, it fails to apply the derived encryption key to the actual workspace contents. Consequently, files placed in the workspace remain unencrypted on the removable USB media, allowing an attacker with physical access to read sensitive files. The flaw is corrected in version 1.4.9, which implements authenticated AES-256-GCM encryption to seal the workspace properly.
Potential Impact
Sensitive data placed in the advertised 'Encrypted USB Workspace' is stored in cleartext, exposing it to unauthorized disclosure if an attacker gains physical access to the removable media. This undermines the confidentiality guarantees claimed by the product and can lead to data breaches involving sensitive files.
Mitigation Recommendations
Users should upgrade to openssl_encrypt version 1.4.9 or later, where the issue is fixed by properly encrypting the workspace using authenticated AES-256-GCM encryption. Until upgrading, users should not rely on the workspace encryption feature to protect sensitive data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-27T11:11:30.933Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a906bb2acd9273b4983a194
Added to database: 08/27/2026, 16:54:10 UTC
Last enriched: 10/02/2026, 15:54:44 UTC
Last updated: 10/09/2026, 18:48:23 UTC
Views: 54
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.