Description

openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to sanitize it. As a result the token is printed in cleartext to stderr under --debug (even without --unsafe-show-secrets), persisting the credential in logs and terminal history. Fixed in 1.4.9.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-08-27T17:21:01.733Z",
  "pubdate": "2026-08-27T17:21:01.733Z",
  "executiveSummary": "The openssl-encrypt pip package (versions 1.4.8 and earlier) is susceptible to an information disclosure vulnerability caused by improper sanitization of sensitive arguments during debug operations.\nSpecifically, the 'keyserver set-token' command fails to redact the bearer token provided as a positional argument when the application is executed with the --debug flag.\nThis results in the cleartext leakage of sensitive authentication credentials directly to stderr.\nThe exposure persists in system logs, shell command history, and terminal output, effectively circumventing standard security controls such as the --unsafe-show-secrets flag.\nAn attacker with access to log files, local terminal histories, or system monitoring streams could extract these credentials to gain unauthorized access to the target keyserver.\nThis vulnerability represents a significant risk to credential confidentiality, as it enables lateral movement or unauthorized resource access without requiring direct interaction with the secret management backend.",
  "technicalDetails": "The vulnerability originates within the command-line argument processing logic of the openssl-encrypt package, specifically within the sanitize_argv_for_debug function.\nIn affected versions (<= 1.4.8), the argument parsing mechanism fails to implement a robust redaction routine for the keyserver set-token command structure.\nWhen a user executes the application using the --debug flag, the package initiates a diagnostic dump of the argv (argument vector) array. Because the bearer token is passed as a positional argument to the set-token sub-command, the sanitize_argv_for_debug function lacks the necessary regex or mapping logic to identify and mask this specific sensitive input.\nConsequently, the full command line—including the raw bearer token—is transmitted to stderr.\nThis behavior occurs regardless of the presence of the --unsafe-show-secrets flag, which is intended to restrict the output of sensitive information; the logic flaw effectively treats the secret as a standard positional argument rather than a sensitive credential.\nThe attack flow proceeds as follows: An attacker with low-privileged local access monitors processes or reviews archived system logs where stderr is redirected. Upon the execution of the vulnerable command by an authorized user or an automated script, the full command-line string is captured in plain text within the log environment.\nPost-exploitation, the harvested token can be replayed by the attacker to authenticate against the keyserver, bypassing the intended security restrictions on token lifecycle management.\nBecause this information is written to stdout/stderr streams, it is often ingested by log aggregators, SIEM platforms, and local .bash_history or .zsh_history files, expanding the attack surface beyond the local host to any administrative infrastructure that archives application logs.\nThe root cause is an incomplete implementation of input sanitization filters within the debug diagnostic routines, which failed to account for positional parameter sensitivity in the keyserver token update workflow.\nThis issue was addressed in version 1.4.9, where the sanitization routine was updated to specifically target and redact sensitive positional arguments within the keyserver subcommand context."
}