Vulnerability · Published Oct 22, 2026 · Assigned by OpenVPN
CVE-2026-106017
Medium 6.3
In plain English
A medium-severity improper certificate validation in OpenVPN 3 Core Library from OpenVPN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.2%top 90.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | openvpn3-client | no fix listed | DEBIAN-CVE-2026-106017 |
| Debian:14 | openvpn3-client | no fix listed | DEBIAN-CVE-2026-106017 |
| Ubuntu:22.04:LTS | openvpn | no fix listed | UBUNTU-CVE-2026-106017 |
| Ubuntu:24.04:LTS | openvpn | no fix listed | UBUNTU-CVE-2026-106017 |
| Ubuntu:26.04:LTS | openvpn | no fix listed | UBUNTU-CVE-2026-106017 |
| Ubuntu:26.10 | openvpn | no fix listed | UBUNTU-CVE-2026-106017 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenVPN | OpenVPN 3 Core Library | 3.4 – through 3.11.7 |
Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U