CVE-2026-81686

openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations (to 0/negative, causing the concurrency gate to refuse all subsequent operations, or to a huge value removing the limit) or the unbounded DefaultTimeout, resulting in a persistent denial of service of the root daemon. The D-Bus service exists only on the 1.4.x line and was removed in 1.5.x.

• CWE-20

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-7fhx-8rmv-qjj3Vendor Advisory
• https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-d-bus-properties-authorization-bypassThird Party Advisory

Published

Aug 27, 2026

Last Modified

Sep 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-81680openssl_encrypt versions before 1.4.9 fail to authenticate r…5.3
• CVE-2026-81681openssl_encrypt (pip package openssl-encrypt) versions <= 1.…4.6
• CVE-2026-81682openssl_encrypt versions before 1.4.9 contain an insecure fi…6.2
• CVE-2026-81683openssl_encrypt (pip package openssl-encrypt) versions 1.4.8…5.5
• CVE-2026-81684In openssl_encrypt (pip package openssl-encrypt) versions <=…6.2
• CVE-2026-81685openssl_encrypt versions before 1.4.9 fail to sanitize recov…3.3
• CVE-2026-81687openssl_encrypt versions before 1.4.9 fail to enforce a time…5.5
• CVE-2026-81688openssl_encrypt versions before 1.4.9 store an unkeyed SHA-2…7.5
• CVE-2026-81689openssl_encrypt versions before 1.4.9 derive the remote-pepp…7.5
• CVE-2026-8169ExtremeXOS (EXOS) uses a challenge-response mechanism to aut…8.7
• CVE-2026-81690openssl-encrypt (pip package) before 1.4.9 contains a symlin…7.3
• CVE-2026-81691openssl_encrypt versions before 1.4.9 fail to validate serve…7.5