CVE-2026-81705 - openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug

[Starburst-David]

CVE ID :CVE-2026-81705
Published : Aug. 27, 2026, 5:21 p.m. | 48 minutes ago
Description :openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2>&1 output, CI job logs, or the GUI's persistent debug log) can recover the password.
Severity: 8.7 | HIGH

More Information:
https://cvefeed.io/vuln/detail/CVE-2026-81705