Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-81702, describes a key substitution issue in openssl_encrypt where the Identity.load function fails to re-derive and validate fingerprints from identity.json. This allows attackers to replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid. The advisory explicitly states that the fix involves Identity.load calling check_fingerprint_consistency() and add_identity comparing recomputed fingerprints, and references gitlab#230.
My analysis involved the following steps:
<= 1.4.8, patched 1.4.9.get_repo_tags to find the SHAs for v1.4.8 and v1.4.9.compare_two_commits to retrieve commits between v1.4.8 and v1.4.9. While many security-related commits were found, none explicitly mentioned 'fingerprint' or 'identity.json' in their messages, nor did they reference gitlab#230. This indicated that the fix might be part of a larger commit or have a less descriptive message.1.4.9 release, I decided to directly inspect the code in the patched version (current main branch) for the functions mentioned in the advisory (Identity.load, add_identity, check_fingerprint_consistency).get_file_content to list files in openssl_encrypt/modules/ and identified identity.py as a likely candidate for containing Identity.load and IdentityStore.add_identity.openssl_encrypt/modules/identity.py.identity.py, I found explicit code blocks within both the Identity.load method and the IdentityStore.add_identity method that perform the described fingerprint re-derivation and validation. These code blocks were accompanied by comments referencing gitlab#230, directly linking them to the vulnerability fix.The core of the vulnerability was the implicit trust placed on the fingerprint field within identity.json without cryptographic verification against the actual public keys. An attacker could craft a malicious identity.json file with a valid-looking fingerprint but pointing to their own public keys. The patched Identity.load and IdentityStore.add_identity functions now recompute the fingerprint from the public key files and compare it to the stored one, failing if there's a mismatch. This prevents the silent substitution of keys and ensures data authenticity. These functions are considered vulnerable because they lacked this critical validation in versions prior to 1.4.9.
Identity.loadopenssl_encrypt/modules/identity.py
IdentityStore.add_identityopenssl_encrypt/modules/identity.py