CVE-2026-81714 openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass

opensslencrypt pip: openssl-encrypt versions = 1.4.8 use suffix-tolerant fingerprint matching in enrolltrustkey when binding a plugin-signing trust anchor. An operator who confirms a short forgeable, 32-bit GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which...

CVE-2026-81714

openssl_encrypt (pip package openssl-encrypt) versions ≤ 1.4.8 are vulnerable to a plugin-signing trust anchor enrollment bypass in the enroll_trust_key function. The function uses suffix-tolerant fingerprint matching , so an operator who confirms a short (~32-bit) GPG key ID could unknowingly en...