CVE-2026-81684
In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the --stego-password argument (on both encrypt and decrypt paths) instead of via an environment variable as done for the main password. Any local user can read the steganography password from /proc/<pid>/cmdline for the lifetime of the subprocess. Fixed in 1.4.9.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.12%
- CWE
- CWE-214
- Published
- 2026-08-27
- Last modified
- 2026-08-28
Affected products
- jahlives openssl_encrypt
- jahlives openssl_encrypt
Weakness type
Related vulnerabilities
- CVE-2026-80158 — Ansible-collection-community-general: community.general: ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the ipa bind password in logs and process listings
- CVE-2026-65088 — NVIDIA NemoClaw contains a vulnerability where an attacker could cause...
- CVE-2026-76054 — Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17...
- CVE-2026-74873 — openssl_encrypt before 1.4.0 Password Exposure via CLI Argument
- CVE-2026-18915 — Exposure of OTP Secret Through Process Command-Line Arguments in TÜBİTAK BİLGEM's eta-otp-lock
- CVE-2026-12139 — Tanium addressed an information disclosure vulnerability in Connect.
- CVE-2026-9494 — ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line
- CVE-2026-12250 — Sensitive Data Exposure in TUBITAK BILGEM's Pardus Domain Joiner