VULNERABILITY INTELLIGENCE

CVE-2026-81715

CVSS score3.3 LOW
EPSS probability0.26%
CISA KEVNot currently listed
Published2026-08-27
Last modified2026-09-03
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to sanitize it. As a result the token is printed in cleartext to stderr under --debug (even without --unsafe-show-secrets), persisting the credential in logs and terminal history. Fixed in 1.4.9.

Weakness classification

  • disclosure@vulncheck.com: CWE-532

Primary references