{"id":"CVE-2026-106017","kind":"vulnerability","aliases":["CVE-2026-106017"],"related":[],"title":"OpenVPN 3 Core: certificate checks can be bypassed, skipping key usage restrictions","description":"Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions.","summary":"The OpenVPN 3 Core library, versions 3.4 through 3.11.7, does not validate certificates properly. An attacker can get around extended key usage restrictions, so a certificate meant for another purpose may be accepted.","severity":"medium","cvss":6.3,"epss":0.00195,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","openvpn","package","tls","vpn"],"not_affected_if":["does-not-use-openvpn-3-core"],"how_to_check":"- Find the OpenVPN 3 Core library version in your dependencies or build, for example in the lockfile or vendored source; unknown if the sources do not say which packages embed it.\n- Check whether the version is between `3.4` and `3.11.7`.","fix":"- Move to an OpenVPN 3 Core release newer than `3.11.7`; unknown which exact version fixes it, as the sources do not say.","status":"open","published_at":"2026-10-22T10:17:07+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:01:16+00:00","updated_at":"2026-10-25T04:01:16+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:01:16Z","model":"claude-haiku-5-5","output":{"fix":"- Move to an OpenVPN 3 Core release newer than `3.11.7`; unknown which exact version fixes it, as the sources do not say.","reach":"network","title":"OpenVPN 3 Core: certificate checks can be bypassed, skipping key usage restrictions","impact":"medium","summary":"The OpenVPN 3 Core library, versions 3.4 through 3.11.7, does not validate certificates properly. An attacker can get around extended key usage restrictions, so a certificate meant for another purpose may be accepted.","category":"package","nicknames":[],"who_cares":["openvpn","vpn","tls","c++"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker presents a certificate outside its intended key usage and gets accepted.","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-106017 for the fixed version and affected products embedding OpenVPN 3 Core.","how_to_check":"- Find the OpenVPN 3 Core library version in your dependencies or build, for example in the lockfile or vendored source; unknown if the sources do not say which packages embed it.\n- Check whether the version is between `3.4` and `3.11.7`.","needs_analyst":true,"not_affected_if":["does-not-use-openvpn-3-core"],"who_is_affected":"Teams that build or ship software embedding the OpenVPN 3 Core library for VPN client or server connections are exposed, since the flaw is in certificate validation during the TLS handshake. Applications that do not use OpenVPN 3 Core can skip it. The sources do not say which products embed the library.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000638,"input_tokens":3319,"output_tokens":613,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-106017':15A,18A '-2026':14A,17A '3':2A,26B,63C '3.11.7':32B,69C '3.4':30B,67C 'accept':56B 'allow':70C 'anoth':52B 'around':42B 'attack':39B,71C 'bypass':8A 'c':19B 'certif':4A,36B,49B,58C 'check':5A 'circumv':73C 'core':3A,27B,64C 'cve':13A,16A 'extend':43B,74C 'get':41B 'improp':57C 'key':10A,44B,75C 'librari':28B,65C 'may':54B 'meant':50B 'openvpn':1A,20B,25B,62C 'packag':21B 'proper':37B 'purpos':53B 'restrict':12A,46B,77C 'skip':9A 'tls':22B 'usag':11A,45B,76C 'valid':35B,59C 'version':29B,66C 'vpn':23B","nicknames":[],"mitigations":[],"who_affected":"Teams that build or ship software embedding the OpenVPN 3 Core library for VPN client or server connections are exposed, since the flaw is in certificate validation during the TLS handshake. Applications that do not use OpenVPN 3 Core can skip it. The sources do not say which products embed the library.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T10:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@openvpn.net","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106017","severity":null,"published_at":"2026-10-22T10:17:07+00:00","modified_at":"2026-10-22T15:25:35+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-106017","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106017","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}