CVE-2026-81683: Cleartext Storage of Sensitive Information in jahlives openssl_encrypt

The vulnerability CVE-2026-81683 affects the openssl_encrypt package versions 1.4.8 and earlier. These versions store an mTLS client private key in cleartext within a SharedPreferences file that has world-readable permissions (0644). This occurs through the desktop GUI's Settings screen where users input a combined certificate and private key PEM field. Because the file is world-readable, any local attacker with access to the file system can read the private key, compromising client authentication credentials. The issue is fixed in version 1.4.9, which changes the storage method to write the PEM to a dedicated file with restrictive permissions (0600), stores only the file path in SharedPreferences, and migrates existing cleartext entries by scrubbing them.

The vulnerability allows local attackers with file system access to obtain sensitive mTLS client private keys stored in cleartext, potentially enabling impersonation or unauthorized access to systems relying on these credentials. The exposure of private keys undermines the confidentiality and integrity of client authentication mechanisms. However, exploitation requires local access to the affected system's file storage.

Upgrade to openssl_encrypt version 1.4.9 or later, which implements secure storage of the private key by writing it to a dedicated file with 0600 permissions and removes cleartext storage from SharedPreferences. This version also migrates and scrubs previously stored cleartext keys. No additional mitigation is required if the upgrade is applied.