CVE-2026-81714
HighCVSS 7.0Summary
openssl_encrypt versions up to 1.4.8 use suffix-tolerant fingerprint matching when binding a trust anchor. An operator confirming a short, forgeable GPG key id could unknowingly enroll an attacker's colliding key as trusted. Version 1.4.9 requires exact full primary-key fingerprint match.
Risk Assessment
The organization may accept malicious plugins as trusted, leading to unauthorized code execution under ENFORCE policy.
Recommendation
Upgrade openssl_encrypt to 1.4.9 or later to enforce exact fingerprint matching.
Original NVD description (English source)
openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forgeable, ~32-bit) GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which then vouches for malicious plugins under the ENFORCE signature policy. Version 1.4.9 fixes this by requiring the confirmed value to exactly match the full primary-key fingerprint (case-insensitive, whitespace-stripped).