CVE-2026-84790 Auth bypass in OpenVPN
Remote authenticated users can impersonate others via crafted certificate subject fields in OpenVPN, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84790?
CVE-2026-84790 is a high-severity authentication bypass vulnerability in OpenVPN, published on 13 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field
Which versions are affected by CVE-2026-84790?
How do I fix CVE-2026-84790?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-84790 being exploited?
There is no known exploitation of CVE-2026-84790 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-84790, GHSA-6f9v-9427-9fpm, UBUNTU-CVE-2026-84790, USN-8953-1.