External risk intelligence

openssl-encrypt USB Drive Integrity Bypass and Key Derivation Weaknesses.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-81717

The vulnerabilities exist within a portable USB drive feature designed to handle removable media. The threat model explicitly requires physical access to the USB drive, and the functionality is inherently local, involving physical hardware interaction rather than remote network exposure or public-facing internet services.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses weaknesses in a specific Python package's portable USB drive functionality. The issues involve insufficient file integrity checks and a predictable encryption key derivation method, which could be exploited if an attacker has physical write access to the USB drive. The primary concern is to confirm if this feature is in use and exposed to such a threat model.

Weaknesses in USB drive feature.
Confirm if this specific feature is in use.
Assess relevance and exposure of USB drive feature.

Attack Path

How an attacker could exploit the issue

An attacker with physical access to a USB drive could potentially compromise the system by adding malicious files that bypass integrity checks. Additionally, a weakness in how encryption keys are derived for drives without a specific salt file makes it possible to perform offline attacks to crack the encryption. This could lead to unauthorized access to sensitive data stored on the drive.

Attacker needs physical USB access.
Malicious files bypass integrity checks.
Encryption key weakness enables offline attacks.

Live Threat

Current exploitation, exposure, and threat context

The `openssl_encrypt` package's portable USB drive feature could be at risk when an untrusted USB drive is used. If an attacker has physical write access to the drive, they could bypass integrity checks by adding unauthorized files, including root-level payloads. Furthermore, a predictable KDF salt could allow for offline rainbow table attacks against the drive's encryption key when a per-drive salt is not present.

System data on USB drives.
Untrusted files bypass integrity checks.
Unauthorized code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The `openssl-encrypt` Python package's portable USB drive feature is vulnerable to integrity bypass and offline decryption attacks. Identifying where this feature is used, confirming its reachability or criticality, and locating the accountable owner are the first practical steps. Remediation planning should then be based on the assessed risk, considering potential vendor coordination if the feature is part of a larger solution.

Ownership: Application owners and infrastructure teams.
Verify first: Usability of USB drive feature and reachability.
Action: Plan risk-based remediation with vendors.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the openssl-encrypt package?

The openssl-encrypt pip package is a Python library that provides cryptographic wrappers. Specifically, the affected versions include a portable USB drive feature intended to manage and encrypt removable storage media, allowing users to handle data transport securely.

How does CVE-2026-81717 affect security?

This CVE involves improper verification of cryptographic signatures, classified under CWE-347. It contains two flaws: an integrity bypass that ignores unauthorized files on a drive, and a weak key derivation process that uses a constant, hardcoded salt, making the encryption susceptible to offline password-cracking attempts.

Do I need physical access to trigger this bug?

Yes. The vulnerability assumes an attacker has physical write access to the USB drive. Standard file operations that do not involve modifying the drive's contents or injecting unauthorized files are not the primary triggers for this specific integrity bypass.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that exploitation is very unlikely in most environments. Because the vulnerability is confined to local, physical interactions with removable hardware, it lacks the remote network exposure typically required for broad internet-based attacks.

What steps should I take if I use this software?

First, identify if your applications utilize the portable USB drive feature within the openssl-encrypt package. If the feature is in use, verify if you are running version 1.4.9 or later, which addresses these flaws. Coordinate with your application owners to plan updates based on your specific use of removable media.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.