openssl-encrypt CVE-2026-81705

Two conditions must both be true for exploitation: (1) the user invokes openssl-encrypt with the --debug flag enabled, and (2) the file password is supplied via a bundled short-option spelling (e.g., -apPassword, where the password immediately follows -p without a space as part of a bundled option token) or an abbreviated long-option spelling (e.g., --passw=Password or --pass=Password accepted as prefixes of --password). The attacker must additionally have read access to the debug output - via public CI job log, terminal scrollback, merged 2>&1 redirect to a shared file, or the GUI's persistent debug log. Passwords supplied via the exact canonical forms --password=value or -p value are correctly redacted and are not exposed. Deployments that do not use --debug mode are entirely unaffected. The vulnerability does not exist in default invocations without the debug flag.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects the scenario in which debug output is aggregated into network-accessible logs - most critically, public CI pipeline job logs where any internet user can read the output without authentication. In that context the score is defensible: no special conditions are imposed on the attacker beyond the target having run the tool with --debug and a vulnerable argument form. However, in environments where log access is restricted (private CI, local-only stderr), effective exploitability is substantially lower and closer to an AV:L/PR:L profile. EPSS data is not provided. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified at time of analysis. The primary real-world risk is credential exposure in CI/CD pipelines encrypting artifacts or secrets with openssl-encrypt while debug logging is active. Because the tool is a niche wrapper with limited enterprise footprint, the population of affected deployments is small, though within that population the impact of a recovered encryption password is full confidentiality compromise of the protected files.

An attacker monitoring the public job logs of a GitHub Actions pipeline sees that openssl-encrypt is invoked with --debug and the argument -apS3cr3tKey (a bundled short-option supplying the password inline). Because the sanitizer does not recognize this form, the string S3cr3tKey appears in cleartext in the stderr debug dump captured in the log. The attacker records the password and uses it to decrypt any intercepted or publicly accessible encrypted output artifacts from the same pipeline. No exploit tooling is required beyond log access and basic argument parsing knowledge.