---
id: CVE-2026-81706
title: openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing
summary: >-
  openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own
  identities and contacts in IdentityStore, allowing attackers to create
  shadowed contact entries invisible until the corresponding own identity is
  deleted. Whe…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-345
vendor: jahlives
product: openssl_encrypt
affected:
  - openssl_encrypt < 1.4.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-27T17:38:49.457236Z'
published: '2026-08-27'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T15:21:33.701Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-81706'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-8gmx-w9m8-vx7q
    label: GitHub Security Advisory (GHSA-8gmx-w9m8-vx7q)
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-key-substitution-via-identity-shadowing
    label: >-
      VulnCheck Advisory: openssl_encrypt before 1.4.9 Key Substitution via
      Identity Shadowing
tags:
  - cve.org
  - osv
  - pip
epss: 0.00181
epssPercentile: 0.07588
aliases:
  - PYSEC-2026-3781
  - GHSA-8gmx-w9m8-vx7q
ecosystem: pip
patched:
  - openssl-encrypt 1.4.9
ingestedAt: '2026-09-02T19:31:26.279Z'
---

## Overview

openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes visible and resolves to the attacker's keys, enabling silent key substitution for encrypted files.

## Affected

- `openssl_encrypt < 1.4.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-81706)

Affected packages:

- `openssl-encrypt < 1.4.9`

Patched in:

- `openssl-encrypt 1.4.9`

Source: https://osv.dev/vulnerability/PYSEC-2026-3781