CVE-2026-81715: Insertion of Sensitive Information into Log File in jahlives openssl_encrypt

In the openssl_encrypt package (pip package openssl-encrypt) versions less than 1.4.9, the function sanitize_argv_for_debug fails to sanitize the keyserver bearer token passed as a positional argument to the 'keyserver set-token' command. As a result, when the package is run with the --debug argument, the bearer token is printed in cleartext to stderr, even without the --unsafe-show-secrets flag. This leads to sensitive credential leakage in logs and terminal history. The vulnerability is identified as CVE-2026-81715 and has a CVSS 4.0 score of 8.7 (high severity). The issue is fixed in version 1.4.9.

Sensitive bearer tokens used for keyserver authentication can be exposed in cleartext in debug output, logs, and terminal history. This exposure could allow unauthorized parties to obtain credentials if they have access to these logs or histories. There is no indication of privilege requirements or user interaction needed, increasing the risk of exposure during debugging. No known exploits in the wild have been reported.

Upgrade the openssl_encrypt package to version 1.4.9 or later, where the issue is fixed. Avoid using the --debug flag in production environments or where sensitive tokens are involved until the upgrade is applied. No other mitigations are indicated by the vendor advisory.