Is CVE-2026-106017 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106017 being exploited in the wild.

How severe is CVE-2026-106017?

Informational severity, published 22 October 2026.

Which products and versions are affected?

Openvpn 3 Core 3.4 through 3.11.7.

Is there a fix for CVE-2026-106017?

Yes: fixed in OpenVPN 3 Core Library v3.11.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106017 attacked?

It is attacked over the network or from the adjacent network.

Am I affected by CVE-2026-106017?

Check whether you run Openvpn 3 Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106017: OpenVPN 3 Core certificate validation bypass in extended key usage

CVE-2026-106017 · Severity: info · Published 2026-10-22

OpenVPN 3 Core is a library that enables secure VPN connections for protecting sensitive network traffic. A flaw in certificate validation allows an attacker with any certificate from the client's trusted CA to impersonate the VPN server and intercept all traffic, because the library silently ignores serverAuth requirements specified in the client's configuration.

Vendors: Openvpn.

Quick answers

Is CVE-2026-106017 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106017 being exploited in the wild.
How severe is CVE-2026-106017?: Informational severity, published 22 October 2026.
Which products and versions are affected?: Openvpn 3 Core 3.4 through 3.11.7.
Is there a fix for CVE-2026-106017?: Yes: fixed in OpenVPN 3 Core Library v3.11.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106017 attacked?: It is attacked over the network or from the adjacent network.
Am I affected by CVE-2026-106017?: Check whether you run Openvpn 3 Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: OpenVPN 3 Core Library v3.11.8

Technical details

The profile option parser (KUParse) in OpenVPN 3 Core fails to enforce the remote-cert-tls configuration option during profile parsing, allowing a man-in-the-middle attacker to present a valid certificate without the serverAuth extended key usage attribute. This affects versions 3.4 through 3.11.7 and requires network proximity and a certificate issued by the client's configured CA, but no user interaction.

Affected products

OpenVPN 3 Core 3.4 through 3.11.7

Timeline

2026-10-22: disclosed

References

https://community.openvpn.net/Security%20Announcements/CVE-2026-106017

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.