CVE-2026-81686: openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass
opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations (to 0/negative, causing the concurrency gate to refuse all subsequent operations, or to a huge value removing the limit) or the unbounded DefaultTimeout, resulting in a persistent denial of service of the root daemon. The D-Bus service exists only on the 1.4.x line and was removed in 1.5.x.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.9 - Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.5.x
Event History
Frequently Asked Questions
Which deployments are exposed?
Only openssl_encrypt 1.4.x releases before 1.4.9 are affected, and only where the optional D-Bus crypto service is present on the system bus. The service was removed in the 1.5.x line.
What access does an attacker need?
An attacker needs local access to the system and the ability to call the D-Bus Properties.Set method on the system bus. No prior authorization or polkit approval is required by the affected method.
What can an attacker change and what is the impact?
An attacker can set MaxConcurrentOperations to zero or a negative value, preventing subsequent operations, or set it to a very large value to remove the concurrency limit. They can also set the unbounded DefaultTimeout, resulting in persistent denial of service of the root daemon.
What can be done if upgrading is not immediately possible?
Disable or remove access to the optional D-Bus crypto service on the system bus, since the vulnerable operation is exposed through that service. Restricting local users from calling its Properties.Set method addresses the unauthorized configuration changes described.