Is CVE-2026-81714 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-81714?

CVE-2026-81714 has a CVSS v3 severity of HIGH (7).

Back

CVE-2026-81714

Description

openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forgeable, ~32-bit) GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which then vouches for malicious plugins under the ENFORCE signature policy. Version 1.4.9 fixes this by requiring the confirmed value to exactly match the full primary-key fingerprint (case-insensitive, whitespace-stripped).