{"id":"CVE-2026-81715","title":"openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to saniti…","summary":"openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to saniti…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-532"],"vendor":"jahlives","product":"openssl_encrypt","affected":["openssl_encrypt < 1.4.9"],"patched":["openssl_encrypt 1.4.9"],"published":"2026-08-27","updated":"2026-09-03","sourceUpdated":"2026-09-03T15:09:44.487","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81715","references":[{"url":"https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-jqqp-pf9j-889j","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-credential-exposure-via-debug-output","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-08-27T18:38:43.894915Z"},"ingestedAt":"2026-09-14T12:46:18.847Z","epss":0.00261,"epssPercentile":0.15853,"slug":"CVE-2026-81715","body":"## Overview\n\nopenssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to sanitize it. As a result the token is printed in cleartext to stderr under --debug (even without --unsafe-show-secrets), persisting the credential in logs and terminal history. Fixed in 1.4.9.\n\n## Affected\n\n- `openssl_encrypt < 1.4.9`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `openssl_encrypt 1.4.9`","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}