# CVE-2026-81704: openssl_encrypt weak key derivation in D-Bus EncryptFile handler

Source: https://junglewise.ai/threats/cve-2026-81704-openssl-encrypt-weak-key-derivation-in-d-bus-encryptfile-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81704 · Severity: high · CVSS 7.5 · Published 2026-08-27

openssl_encrypt is a Python library for encrypting files. The D-Bus service component used to encrypt files via system or session bus was deriving encryption keys using only SHA-256 hashing without proper stretching, rather than the documented Argon2id algorithm. This makes encrypted files vulnerable to offline password guessing attacks that are millions of times faster than intended, potentially exposing encrypted data if an attacker obtains the files.

Technologies: [Jahlives Openssl Encrypt](https://junglewise.ai/threats/technologies/openssl-encrypt), [openssl-encrypt (PyPI)](https://junglewise.ai/threats/technologies/pypi-openssl-encrypt). Vendors: [Jahlives](https://junglewise.ai/threats/vendors/jahlives), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-81704 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81704 being exploited in the wild.

**How severe is CVE-2026-81704?** High severity, with a CVSS score of 7.5, published 27 August 2026.

**Which products and versions are affected?** Jahlives Openssl Encrypt before 1.4.9; openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.

**Is there a fix for CVE-2026-81704?** Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81704 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-81704?** Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- openssl-encrypt (PyPI): upgrade to 1.4.9 or later

  ```sh
  pip install "openssl-encrypt>=1.4.9"
  ```


## Technical details

The vulnerability is a weak key derivation failure (CWE-916) in the D-Bus CryptoService.EncryptFile handler. The handler constructed a hash configuration dictionary with incorrect key names that the key-derivation core does not recognize, causing the core to skip KDF application entirely and fall back to a single unstretched SHA-256 hash of the password and salt. This results in offline password guessing being approximately 10^6–10^7 times faster than intended (roughly 10^10 SHA-256 operations per second on commodity GPUs versus 10^3 per second against Argon2id with 64 MiB memory cost). The vulnerability affects only files encrypted via the D-Bus service; CLI and GUI encryption paths are unaffected. Version 1.4.9 fixes the issue by moving key derivation configuration to a dedicated module that correctly constructs the config structure and enforces Argon2id by default, rejecting encryption requests that do not meet minimum work-factor requirements. Affected versions are 1.4.8 and earlier; the D-Bus service was removed entirely in the 1.5.x line.

## Affected products

- jahlives openssl_encrypt before 1.4.9

## Identifiers

- CVE-2026-81704
- PYSEC-2026-3963

## Timeline

- 2026-08-12: disclosed
- 2026-08-27: patched: Version 1.4.9 released

## References

- [https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-v9r6-grch-fxw7](https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-v9r6-grch-fxw7)
- [https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-weak-key-derivation-via-d-bus](https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-weak-key-derivation-via-d-bus)

## Related threats

- [openssl_encrypt KDF cost parameter validation bypass](https://junglewise.ai/threats/cve-2026-81721-openssl-encrypt-kdf-cost-parameter-validation-bypass)
- [openssl_encrypt memory exhaustion in identity file protection block](https://junglewise.ai/threats/cve-2026-81720-openssl-encrypt-memory-exhaustion-in-identity-file-protection)
- [openssl_encrypt arbitrary code execution via plugin signature bypass](https://junglewise.ai/threats/cve-2026-81719-openssl-encrypt-arbitrary-code-execution-via-plugin-signature)
- [openssl_encrypt weak PBKDF2 parameters in keyfile encryption](https://junglewise.ai/threats/cve-2026-81718-openssl-encrypt-weak-pbkdf2-parameters-in-keyfile-encryption)
- [openssl_encrypt USB drive integrity bypass with fixed KDF salt](https://junglewise.ai/threats/cve-2026-81717-openssl-encrypt-usb-drive-integrity-bypass-with-fixed-kdf-salt)