{"cve":"CVE-2026-81681","nvd":{"published":"2026-08-27T17:20:57.453","modified":"2026-09-02T13:13:05.633","status":"Analyzed","description":"openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption key is never applied to it. A user who trusts the branding and places files in the workspace leaves them unencrypted on the removable media, so an attacker with physical access to the media can read the sensitive files. Fixed in 1.4.9, which seals the workspace into an authenticated AES-256-GCM vault.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":4.6},"cwes":["CWE-311"],"references":["https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-2jv6-qqfm-m46m","https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-false-encryption-via-cleartext-storage"],"products":["jahlives:openssl_encrypt"],"source":"nvd","synced_at":"2026-10-19T22:50:17.453294893+00:00"},"epss":{"cve":"CVE-2026-81681","score":0.00172,"percentile":0.06566,"date":"2026-10-31"},"kev":null,"osv":[{"id":"PYSEC-2026-3791","url":"https://osv.dev/vulnerability/PYSEC-2026-3791","summary":"","modified":"2026-09-03T11:00:04.958614929Z","packages":[{"ecosystem":"PyPI","name":"openssl-encrypt","purl":"pkg:pypi/openssl-encrypt","ranges":["<1.4.9"],"fixed":["1.4.9"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}