Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 CRITICAL: CVE-2026-81700 (CVSS 9.8) openssl_encrypt <1.4.9 fails to validate revoked/expired GPG keys, allowing attackers to execute malicious plugins. ✅ Update to v1.4.9+ immediately #CVE #PatchNow #CyberSecurity https://t.co/RpTlOydyoQ
Post summary
The tweet announces CVE-2026-81700, a critical flaw in openssl_encrypt that allows plugin execution via invalid GPG keys, and urges users to update to version 1.4.9+ immediately.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jahlives | openssl_encrypt | - | python | - |