{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/openssl_encrypt/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-81702"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["openssl_encrypt (\u003c 1.4.9)","openssl-encrypt (\u003c= 1.4.8)","openssl-encrypt (\u003c 1.4.9)"],"_cs_severities":["critical"],"_cs_tags":["cryptographic-vulnerability","credential-theft","openssl_encrypt","cve-2026-81689","vulnerability","cryptography","denial-of-service","cve-2026-81699"],"_cs_type":"threat","_cs_vendors":["OpenSSL","openssl_encrypt","openssl-encrypt"],"content_html":"\u003cp\u003eThe openssl_encrypt library, specifically versions prior to 1.4.9, contains a critical vulnerability (CVE-2026-81702) in its identity management mechanism. When the library loads identity configurations from the 'identity.json' file, it fails to perform necessary re-derivation and validation of identity fingerprints. This design flaw allows an attacker with local file write access to substitute legitimate public keys with attacker-controlled keys within the identity store. Because the fingerprint validation is skipped or improperly performed, the library continues to associate the manipulated identity store with the original, expected fingerprint. This enables silent key substitution where systems perform encryption using attacker-provided keys while signature verification routines falsely report successful validation, creating significant risks for data interception, spoofing, and man-in-the-middle scenarios within applications relying on this library.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the complete bypass of cryptographic identity verification. An attacker can intercept and decrypt sensitive communications or spoof legitimate entities by presenting a substituted public key that appears valid to the affected software. This poses a high risk of data breach and loss of integrity for any infrastructure or application utilizing openssl_encrypt for key-based authentication or encryption.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade openssl_encrypt to version 1.4.9 or higher across all affected applications immediately.\u003c/li\u003e\n\u003cli\u003eAudit file system permissions for 'identity.json' files to ensure they are write-protected and accessible only by the service process owner.\u003c/li\u003e\n\u003cli\u003eScan environments for the presence of the 'identity.json' file to identify software components that rely on the vulnerable library implementation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-27T21:10:02Z","date_published":"2026-08-27T19:09:25Z","id":"https://feed.craftedsignal.io/briefs/2026-08-openssl-encrypt-identity-vuln/","summary":"The openssl_encrypt library before 1.4.9 is vulnerable to key substitution attacks due to improper fingerprint validation when loading identities from local identity.json files.","title":"CVE-2026-81702 Key Substitution in openssl_encrypt","url":"https://feed.craftedsignal.io/briefs/2026-08-openssl-encrypt-identity-vuln/"}],"language":"en","title":"CraftedSignal Threat Feed - Openssl_encrypt","version":"https://jsonfeed.org/version/1.1"}