---
id: CVE-2026-81706
aliases:
  - PYSEC-2026-3781
  - GHSA-8gmx-w9m8-vx7q
title: >-
  openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own
  identities and contacts in IdentityStore, allowing attacke…
summary: >-
  openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own
  identities and contacts in IdentityStore, allowing attackers to create
  shadowed contact entries invisible until the corresponding own identity is
  deleted. Whe…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'
vendor: openssl-encrypt
product: openssl-encrypt
ecosystem: pip
affected:
  - openssl-encrypt < 1.4.9
patched:
  - openssl-encrypt 1.4.9
published: '2026-08-27'
updated: '2026-09-02'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/PYSEC-2026-3781'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-8gmx-w9m8-vx7q
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-key-substitution-via-identity-shadowing
tags:
  - osv
  - pip
epss: 0.00181
epssPercentile: 0.06823
ingestedAt: '2026-09-02T19:31:26.279Z'
---

## Overview

openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes visible and resolves to the attacker's keys, enabling silent key substitution for encrypted files.

## Affected packages

- `openssl-encrypt < 1.4.9`

## Remediation

Upgrade to a patched release:

- `openssl-encrypt 1.4.9`