CVE-2026-81697 in openssl_encrypt
Summary
by MITRE • 08/27/2026
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 contain a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FILE (originally the absolute per-user path ~/.crypt_settings.json) is reassigned at line 84 to the bare relative name 'crypt_settings.json'. As a result, the legacy Tk GUI's SettingsTab reads and writes KDF settings from crypt_settings.json in the process launch (current working) directory instead of the user's home directory. An attacker who plants a malicious crypt_settings.json (e.g. sha256:1 with all memory-hard KDFs disabled) can silently downgrade encryption performed in that GUI session to roughly one hash round, bypassing the weak-KDF preflight and enabling offline brute-force attacks against the resulting ciphertext. Fixed in 1.4.9.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified within versions of the openssl-encrypt Python package up through release 1.4.8 represents a critical configuration file resolution flaw rooted in improper handling of relative paths during application initialization. The core technical defect resides in the crypt_settings.py module, specifically at line eighty-four where the variable CONFIG_FILE is reassigned from its intended absolute path to a bare relative filename. Originally designed to resolve to ~/.crypt_settings.json within the user's home directory, this reassignment causes the legacy Tk GUI interface to look for and write configuration data into a file named crypt_settings.json located in the current working directory of the process launch environment rather than the secure per-user location. This deviation from expected behavior creates an opportunity for path traversal-like attacks where an attacker can influence application security posture by manipulating files in accessible directories.
The operational impact of this flaw is severe, as it directly compromises the integrity and confidentiality of encrypted data managed by the application. When a user launches the GUI with a malicious crypt_settings.json file present in their current working directory, the application silently loads these compromised settings without raising any warnings or errors regarding weak cryptographic parameters. Specifically, an attacker can configure this local file to disable memory-hard Key Derivation Functions and reduce hashing iterations to approximately one round. This effectively strips away the computational barriers designed to prevent offline brute-force attacks against stored passwords or encryption keys. The vulnerability bypasses the application's built-in preflight checks that are intended to detect and reject weak KDF configurations, allowing the user to proceed with encryption operations under a false sense of security while actually employing critically weakened cryptographic primitives.
From an industry standards perspective, this flaw aligns closely with CWE-22 Improper Limitation of a Pathname to a Restricted Directory, as it involves the use of relative paths that allow access outside the intended secure context. It also relates to CWE-798 Use of Hard-coded Credentials if one considers the default weak configuration as an implicit hardcoding of insecure defaults when no valid absolute path is found or respected. In terms of the MITRE ATT&CK framework, this vulnerability facilitates Initial Access and Defense Evasion tactics by allowing an attacker to manipulate local application settings to weaken security controls without triggering alerts. The ability to silently downgrade encryption strength enables subsequent offline brute-force attacks against ciphertext generated during that session, effectively undermining the confidentiality guarantees provided by the openssl-encrypt tool.
Mitigation for this issue requires immediate upgrading of the openssl-encrypt package to version 1.4.9 or later, where the path resolution logic has been corrected to ensure CONFIG_FILE always resolves to the absolute user-specific home directory path regardless of the current working directory. For environments unable to upgrade immediately, administrators and users should audit their launch directories for any presence of crypt_settings.json files and remove them if they do not originate from a trusted source within the home directory. Additionally, implementing strict file permissions on configuration directories can help prevent unauthorized modification or creation of such settings files by other local processes or users. Regular security audits focusing on how applications resolve relative paths in sensitive contexts are recommended to identify similar vulnerabilities across software ecosystems.