Live › vulnerability › CVE-2026-106017
Go to dashboardThe OpenVPN 3 Core library, versions 3.4 through 3.11.7, does not validate certificates properly. An attacker can get around extended key usage restrictions, so a certificate meant for another purpose may be accepted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that build or ship software embedding the OpenVPN 3 Core library for VPN client or server connections are exposed, since the flaw is in certificate validation during the TLS handshake. Applications that do not use OpenVPN 3 Core can skip it. The sources do not say which products embed the library.
No product ranges from the sources yet.
3.4 and 3.11.7.3.11.7; unknown which exact version fixes it, as the sources do not say.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions.
This page as .md · .json · in your agent: get_signal("CVE-2026-106017")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.