openssl_encrypt Package Vulnerability: Critical CVE-2026-81702 Details
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- openssl_encrypt (c)
- Affected versions
- >= v1.4.7, <= v1.4.7 or >= v1.4.6, <= v1.4.6 or >= v1.4.5, <= v1.4.5 or >= v1.4.4, <= v1.4.4 or >= v1.4.2, <= v1.4.2 or >= v1.4.1rc2, <= v1.4.1rc2 or >= v1.4.1rc1, <= v1.4.1rc1 or >= v1.4.0, <= v1.4.0
- Patched version
- 1.4.9
A critical vulnerability has been confirmed in the openssl_encrypt package. Versions prior to 1.4.9 are affected, allowing potential silent key substitution.
What happened
The openssl_encrypt package before version 1.4.9 contains a critical vulnerability tracked as CVE-2026-81702. This flaw arises from the package's failure to re-derive and validate fingerprints when loading identities from identity.json. As a result, attackers can substitute public keys in identity stores without detection.
This vulnerability affects all versions of openssl_encrypt from 1.4.7 down to 1.4.0, as well as release candidates 1.4.1rc2 and 1.4.1rc1. The issue was first flagged on 2026-08-27T17:21:00.680000+00:00 and confirmed shortly thereafter.
What to do about it
- Immediately upgrade to openssl_encrypt version 1.4.9 or later to mitigate the risk.
- Review your dependency tree to identify and update all instances of the affected package.
- Test your applications thoroughly after the upgrade to ensure proper functionality and security.
- Monitor the NVD and osv sources for any further updates or advisories related to this vulnerability.
How 0Day would have caught this
openssl_encrypt is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using openssl_encrypt version 1.4.7 or earlier, down to version 1.4.0, or release candidates 1.4.1rc2 and 1.4.1rc1.
What should I do right now?
Upgrade to openssl_encrypt version 1.4.9 or later as soon as possible.
Has this vulnerability been exploited in the wild?
No, according to the primary sources, this vulnerability has not been exploited in the wild.