CVE-2026-81715
LowCVSS 3.3Summary
openssl_encrypt (pip package openssl-encrypt) versions up to 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to sanitize it. As a result the token is printed in cleartext to stderr under --debug (even without --unsafe-show-secrets), persisting the credential in logs and terminal history. Fixed in 1.4.9.
Risk Assessment
Leaking the authentication token to logs and terminal history could allow an attacker to capture credentials and gain unauthorized access to protected resources.
Recommendation
Update the openssl-encrypt package to version 1.4.9 or later. Also, purge any logs and terminal history that may contain tokens.
Original NVD description (English source)
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to sanitize it. As a result the token is printed in cleartext to stderr under --debug (even without --unsafe-show-secrets), persisting the credential in logs and terminal history. Fixed in 1.4.9.