CVE-2026-81700
Critical · 9.8CVSS
9.8
EPSS
—
Published
Aug 27, 2026
CISA due date
—
The record
openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-87947 Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO… CWE-347
- CVE-2026-84918 Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment… CWE-347
- CVE-2026-102271 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
- CVE-2026-102272 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
- CVE-2026-102273 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
- CVE-2026-102268 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
- CVE-2026-102266 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
- CVE-2026-73784 A potential security vulnerability in HPE IceWall products could be exploited to tamper… CWE-347