Executive brief
Tunnelblick is an open-source application used to manage OpenVPN connections on macOS. A security flaw allows any local user on a Mac to read sensitive system files that are normally restricted to the root administrator. This could allow an attacker with limited access to steal credentials or other private data from the machine.
Technical details
A symlink following vulnerability exists in the tunnelblick-helper component of Tunnelblick for macOS. The tunnelblickd Unix socket is configured with world-writable permissions (0666) and lacks proper client authorization checks. An attacker can create a malicious .tblk configuration directory containing a symbolic link named config.ovpn that points to a sensitive root-owned file (e.g., /etc/master.passwd). When the attacker requests the 'printSanitizedConfigurationFile' command via the socket, the helper process—running with root privileges—follows the symlink and returns the contents of the target file to the unprivileged user. This issue is fixed in version 9.0beta02.
Affected products
- Tunnelblick Tunnelblick 3.3beta26 through 9.0beta01
Timeline
- 2026-03-09: disclosed: Reported to Tunnelblick developers
- 2026-03-10: other: Vulnerability acknowledged by developers
- 2026-03-28: patched: Version 9.0beta02 released
- 2026-05-05: advisory: NVD advisory published