Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2>&1 output, CI job logs, or the GUI's persistent debug log) can recover the password.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 HIGH severity CVE-2026-81705 (CVSS 7.5) openssl-encrypt <1.4.9 leaks passwords in debug output via certain CLI spellings. Cleartext passwords exposed in logs/terminal output. Patch immediately to v1.4.9+ #CVE #Vulnerability #PatchNow https://t.co/Etsn4wd3gL
Post summary
The tweet announces CVE-2026-81705 affecting openssl‑encrypt, details its password‑leak vulnerability, and urges immediate patching to version 1.4.9 or later.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jahlives | openssl_encrypt | - | python | - |