Improper Certificate Validation in OpenVPN 3 Core Library
CVE-2026-106017

6.3MEDIUM

Key Information:

Vendor

Openvpn
Status
Openvpn 3 Core Library
Vendor
CVE Published:
22 October 2026

What is CVE-2026-106017?

The OpenVPN 3 Core library, specifically versions 3.4 to 3.11.7, contains an improper certificate validation vulnerability. This flaw enables attackers to bypass the extended key usage restrictions, potentially allowing unauthorized access and compromising the integrity of secure communications. Addressing this issue is crucial for maintaining the security posture of affected systems.

Affected Version(s)

OpenVPN 3 Core Library 3.4 <= 3.11.7

References

https://community.openvpn.net/Security%20Announcements/CV...
vendor-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.