CVE-2026-81714: Improper Verification of Cryptographic Signature in jahlives openssl_encrypt

The vulnerability in jahlives openssl_encrypt versions <= 1.4.8 stems from the use of suffix-tolerant fingerprint matching when binding a plugin-signing trust anchor in the enroll_trust_key function. An operator confirming a short (~32-bit) GPG key ID could mistakenly enroll an attacker's colliding key as trusted. This trusted malicious key can then vouch for malicious plugins under the ENFORCE signature policy. Version 1.4.9 addresses this by enforcing exact matching of the full primary-key fingerprint, ignoring case and whitespace, thus preventing such collisions.

An attacker can exploit this vulnerability to have their malicious plugin signed and trusted by the system, bypassing signature verification policies. This could lead to execution of unauthorized or malicious code within environments relying on the vulnerable versions of openssl_encrypt. The CVSS 4.0 score of 9.3 indicates a critical impact with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade to jahlives openssl_encrypt version 1.4.9 or later, which fixes the vulnerability by requiring exact matching of the full primary-key fingerprint during trust anchor enrollment. No other mitigations are indicated or necessary once the upgrade is applied.