CVE-2026-81684
Medium · 6.2CVSS
6.2
EPSS
0.2%
Published
Aug 27, 2026
CISA due date
—
The record
In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the --stego-password argument (on both encrypt and decrypt paths) instead of via an environment variable as done for the main password. Any local user can read the steganography password from /proc/<pid>/cmdline for the lifetime of the subprocess. Fixed in 1.4.9.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-80158 A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. CWE-214
- CVE-2026-65088 NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of… CWE-214
- CVE-2026-18915 Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM… CWE-214
- CVE-2026-12139 Tanium addressed an information disclosure vulnerability in Connect. CWE-214
- CVE-2026-9494 An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly… CWE-214
- CVE-2026-12250 Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM… CWE-214
- CVE-2026-41357 OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in… CWE-214
- CVE-2026-40159 PraisonAI is a multi-agent teams system. CWE-214