Read the docs
TI-2026-24445 Aliases CVE-2026-31893

Tunnelblick arbitrary file read via symlink following in tunnelblickd

Priority MEDIUM 63CWE-61Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-61 and the CVSS impact.

Summary

Tunnelblick is an open source graphic user interface for OpenVPN on macOS. In versions 3.3beta26 through 9.0beta01, any local user can read arbitrary root-owned files by exploiting a symlink following vulnerability in tunnelblick-helper, reachable through the world-accessible tunnelblickd Unix socket. The socket is configured with mode 0666, allowing any local user to connect. No authorization check is performed on the connecting client. The tunnelblick-helper process constructs a path to config.ovpn inside a user-controlled .tblk directory and reads it as root without symlink validation. An attacker can create a .tblk configuration with a symlinked config.ovpn pointing to any file and request tunnelblickd to read it. This issue has been fixed in versions 9.0beta02.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00242 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Tunnelblick (Tunnelblick): 9.0beta02

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TunnelblickTunnelblick3.3beta26 to before 9.0beta029.0beta02Patch availableCNA
  • Tunnelblick VendorTunnelblick Affected 3.3beta26 to before 9.0beta02 Fixed in 9.0beta02 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:tunnelblick:tunnelblick:*:*:*:*:*:*:*:*3.5.3 to before 8.0.1VulnerableTunnelblick
cpe:2.3:a:tunnelblick:tunnelblick:3.3:beta26:*:*:*:*:*:*3.3 beta26VulnerableTunnelblick
cpe:2.3:a:tunnelblick:tunnelblick:8.1:beta01:*:*:*:*:*:*8.1 beta01VulnerableTunnelblick
cpe:2.3:a:tunnelblick:tunnelblick:8.1:beta02:*:*:*:*:*:*8.1 beta02VulnerableTunnelblick
cpe:2.3:a:tunnelblick:tunnelblick:8.1:beta03:*:*:*:*:*:*8.1 beta03VulnerableTunnelblick
cpe:2.3:a:tunnelblick:tunnelblick:9.0:beta01:*:*:*:*:*:*9.0 beta01VulnerableTunnelblick
  • cpe:2.3:a:tunnelblick:tunnelblick:*:*:*:*:*:*:*:* Versions 3.5.3 to before 8.0.1 Vulnerable ·Tunnelblick
  • cpe:2.3:a:tunnelblick:tunnelblick:3.3:beta26:*:*:*:*:*:* Versions 3.3 beta26 Vulnerable ·Tunnelblick
  • cpe:2.3:a:tunnelblick:tunnelblick:8.1:beta01:*:*:*:*:*:* Versions 8.1 beta01 Vulnerable ·Tunnelblick
  • cpe:2.3:a:tunnelblick:tunnelblick:8.1:beta02:*:*:*:*:*:* Versions 8.1 beta02 Vulnerable ·Tunnelblick
  • cpe:2.3:a:tunnelblick:tunnelblick:8.1:beta03:*:*:*:*:*:* Versions 8.1 beta03 Vulnerable ·Tunnelblick
  • cpe:2.3:a:tunnelblick:tunnelblick:9.0:beta01:*:*:*:*:*:* Versions 9.0 beta01 Vulnerable ·Tunnelblick

Remediation

  • Fix · CNA Tunnelblick (Tunnelblick) Fixed in 9.0beta02

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-31893

References

Exploit 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences