OpenVPN 3 Core CVE-2026-106017

Exploitation applies specifically to deployments that depend on Extended Key Usage (EKU) restrictions as a security control to limit which certificates may be accepted for a given role; without reliance on EKU constraints there is nothing to circumvent. The attacker must supply a certificate that is otherwise acceptable to the trust chain but should be rejected by EKU policy, and only OpenVPN 3 Core library versions 3.4 through 3.11.7 are affected. Limiting factors per the CVSS vector: High attack complexity (AC:H) plus a present Attack Requirement (AT:P) mean non-default or specific conditions must hold for the bypass to succeed, which meaningfully constrains real-world exploitation despite the network, no-authentication, no-user-interaction path. The available sources do not describe the exact steps that trigger the faulty validation, so the precise preconditions should be confirmed with the OpenVPN advisory.

This is a moderate-severity, improper-certificate-validation flaw (CWE-295) in the OpenVPN 3 Core library (versions 3.4 through 3.11.7) that lets an attacker circumvent Extended Key Usage (EKU) restrictions. The CVSS 4.0 base score is 6.3 with vector AV:N/AC:H/AT:P/PR:N/UI:N and VC:H/SC:H - meaning network-reachable and unauthenticated, but gated by High attack complexity (AC:H) and a present Attack Requirement (AT:P), so successful exploitation depends on specific conditions rather than being trivially repeatable. The signals are internally consistent and point to a real-but-not-emergency issue: the embedded exploit-maturity metric is E:U (exploit unproven/unreported), there is no CISA KEV listing, and no public proof-of-concept is present in the provided references (the sole reference is the OpenVPN vendor advisory, not exploit code). No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be quoted. The vuln.today decision label is 'this_month', aligning with the high-complexity, no-active-exploitation picture - prioritize for scheduled patching rather than emergency response. The AC:H and AT:P metrics indicate the trigger is non-trivial, but the available sources do not describe the precise mechanism by which EKU validation is bypassed, so the exact attacker-controlled preconditions should be verified against the OpenVPN advisory before finalizing a mitigation plan.

In an environment that relies on EKU restrictions to constrain which certificates may act in a given role (e.g. server vs. client), an attacker who holds a certificate issued under a trusted chain but intended for a different purpose leverages the validation flaw so the OpenVPN 3 Core library accepts it anyway, defeating the intended EKU constraint. Because the CVSS vector is AV:N/PR:N but AC:H/AT:P, this is a network, unauthenticated path that nonetheless requires specific conditions to be met. No public exploit identified at time of analysis; the only reference is the OpenVPN vendor advisory.