Secuno
ENNL
Book demo

CVE-2026-81683

8.4 HIGHEPSS 0.05%
  1. Published27 Aug 2026

Description

openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.

CVSS 3.1 breakdown

Attack vectorLocal
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Jahlives Openssl Encrypt< 1.4.9

Remediation

Fixed in
Jahlives Openssl Encrypt≥ 1.4.9

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-813219.8
CM2507 IP cameras store configured wireless network credentials in cleartext within the…
CVE-2026-150659.1
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to…
CVE-2026-203128.8
As part of Cisco's ongoing commitment to proactive security and product quality, the…
CVE-2026-559978.8
Rancher issues long-lived registration tokens to authenticate nodes and agents joining…
CVE-2026-157219.8
Cleartext storage of sensitive information vulnerability in Bilin Software and…
CVE-2024-580238.4
Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an…

Frequently asked

Is CVE-2026-81683 being actively exploited?

CVE-2026-81683 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.05%.

How severe is CVE-2026-81683?

CVE-2026-81683 has a CVSS 3.1 base score of 8.4, rated high. EPSS estimates a 0.05% probability of exploitation.

Which products are affected by CVE-2026-81683?

Affected products include Jahlives Openssl Encrypt.

How do I fix CVE-2026-81683?

Upgrade affected software to a fixed version, for example Jahlives Openssl Encrypt 1.4.9 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-81683 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.