CVE-2026-81686 openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass

Medium 6.9 Published 27 Aug 2026 Updated 1 Oct 2026

Local attackers can bypass authorization on an optional D-Bus service to modify configuration values, causing persistent denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-81686?

CVE-2026-81686 is a medium-severity missing authorization vulnerability in Jahlives Openssl Encrypt, published on 27 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations (to 0/negative, causing the concurrency gate to refuse all subsequent operations, or to a huge value removing the limit) or the unbounded DefaultTimeout, resulting in a persistent denial of service of the root daemon. The D-Bus service exists only on the 1.4.x line and was removed in 1.5.x.

Weakness: CWE-20

Which versions are affected by CVE-2026-81686?

1 open source package ship an affected version, including openssl-encrypt. It affects 1 product.

Package	Affected	Fixed in
`openssl-encrypt` PyPI	All versions	`1.4.9`

Products include Jahlives Openssl Encrypt.

How do I fix CVE-2026-81686?

Upgrade openssl-encrypt to 1.4.9 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-81686 being exploited?

There is no known exploitation of CVE-2026-81686 in the wild and no public exploit code.

All Jahlives Openssl Encrypt vulnerabilities

Sources

Also known as GHSA-7fhx-8rmv-qjj3, GHSA-jgvp-mwh2-v4m7, PYSEC-2026-3794.