Is CVE-2026-81683 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-81683?

CVE-2026-81683 has a CVSS v3 severity of HIGH (8.4).

Back

CVE-2026-81683

Description

openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.