External risk intelligence

openssl-encrypt Workspace False Encryption Advisory

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-81681

The vulnerability exists in a local software library used to manage encryption on removable USB media. It is a client-side, local-access issue that requires physical possession of the storage device and is not network-reachable or exposed to the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The openssl-encrypt Python package incorrectly advertised a portable USB workspace as encrypted when sensitive files were stored in cleartext. This means that any user trusting the product's branding and placing files into this workspace could have their data exposed if the physical USB media is accessed by an unauthorized party. The primary concern is to confirm if this specific software is in use and if sensitive data is being managed via these workspaces.

Data appears encrypted but is not.
Protects sensitive files on removable media.
Confirm usage and exposure of sensitive data.

Attack Path

How an attacker could exploit the issue

An attacker with physical access to a USB drive that has been branded as an "Encrypted USB Workspace" could potentially access sensitive files. The software package falsely advertises strong encryption for files stored on the USB drive. However, the encryption is never actually applied to the files, leaving them in cleartext and vulnerable to exposure.

Attacker gains physical access to USB media.
User stores files in the advertised workspace.
Files are readable in cleartext.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, users who trust the product's branding as an "Encrypted USB Workspace" may place sensitive files into the designated directory, believing them to be protected by AES-256-GCM encryption. However, the files are actually stored in cleartext on the removable media, allowing an attacker with physical access to the USB drive to read these unencrypted files.

Sensitive user files on USB media.
Physical access to the USB media.
Unencrypted file contents exposed.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts users of the `openssl_encrypt` pip package who rely on its advertised encryption for removable media. Since the actual data is stored in cleartext, the primary concern is unauthorized physical access to the media. Owners of portable devices and the teams managing their use should first identify where this software is deployed and if sensitive data is being stored on these devices. Planning for remediation should consider the risk posed by potential physical theft or loss of the media.

Application owners should investigate usage.
Verify data storage and physical media access.
Plan remediation based on data sensitivity.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the openssl-encrypt Python package?

The openssl-encrypt package is a tool used to manage encrypted workspaces on portable USB drives. It is designed to provide security for files stored on removable media by implementing AES-256-GCM encryption, ensuring that data remains protected even if the physical hardware is lost or stolen.

What is the weakness in CVE-2026-81681?

This vulnerability is classified as CWE-311, which relates to the failure to encrypt sensitive data. In this specific case, the software falsely marks directories as encrypted and provides branding that suggests security, but it fails to apply the encryption process. As a result, all files stored in the workspace remain in cleartext, meaning there is no actual cryptographic protection guarding the information.

How does an attacker trigger this vulnerability?

The vulnerability is triggered simply by storing files within the workspace provided by the affected software. No malicious action is required to activate the flaw because the encryption mechanism never runs. The data is fundamentally unprotected at rest. Simply using the software as intended creates the vulnerability; it is not triggered by specific file types, nor does it require active software intervention to leave the files exposed.

Is this vulnerability reachable over the internet?

No. According to Halo Surface Signal, this is a client-side, local-access issue. The risk is not related to network connectivity or internet exposure. The threat specifically requires an individual to have physical possession of the removable USB storage media to access the unencrypted files.

What should I do if I use this software?

First, identify if your environment relies on the openssl-encrypt package for managing data on removable USB drives. If it is in use, assume any data previously stored in these workspaces is unencrypted and potentially accessible to anyone with physical access to the drive. You should upgrade to version 1.4.9 or later, which seals the workspace into a genuine AES-256-GCM vault, and move any sensitive data from old, vulnerable workspaces to a properly secured location.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.