CVE-2026-81700

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9

Description A signature verification issue exists in the gpg runner.verify detached() function. The system accepts revoked and expired keys because it only checks the VALIDSIG status and fails to inspect REVKEYSIG, EXPKEYSIG, or gpg exit codes. This allows attackers with compromised-then-revoked or expired signing keys to bypass verification and execute malicious plugins within the host process.

Recommendations Update openssl encrypt to version 1.4.9 or later. As a temporary workaround, restrict the use of the gpg runner.verify detached() function until the update is applied.