CVE-2026-106017: CWE-295 Improper certificate validation in OpenVPN OpenVPN 3 Core Library

The vulnerability CVE-2026-106017 affects OpenVPN 3 Core Library versions from 3.4 up to and including 3.11.7. It is caused by improper validation of certificates, specifically allowing attackers to circumvent extended key usage restrictions. This means that certificates which should be restricted in their usage could be accepted improperly, potentially weakening the authentication process. The CVSS 4.0 base score is 6.3, indicating a medium severity level. There is no indication of known exploits in the wild, and no vendor patch or advisory information is provided in the input data.

Attackers could exploit this vulnerability to bypass extended key usage restrictions in certificate validation, potentially allowing unauthorized use of certificates in OpenVPN connections. This could lead to unauthorized access or man-in-the-middle scenarios if attackers can present improperly validated certificates. However, the vulnerability does not require user interaction and has a high attack complexity, which somewhat limits exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided in the input data, users of affected OpenVPN 3 Core Library versions (3.4 through 3.11.7) should monitor OpenVPN vendor advisories for updates and consider restricting usage or applying compensating controls until a fix is available.