# CVE-2026-106017 - OpenVPN 3 Core - remote-cert-tls from a profile silently discarded

Improper certificate validation in the profile option parser (KUParse) of the OpenVPN 3 Core library 3.4 through 3.11.7 allows man-in-the-middle attackers holding any certificate issued by the client's configured CA to impersonate the VPN server via a certificate lacking a serverAuth extended key usage, because `remote-cert-tls` from a client profile is silently discarded during configuration load.

Fixed in [OpenVPN 3 Core Library v3.11.8](https://github.com/OpenVPN/openvpn3/releases/tag/release%2F3.11.8).

CVE record: [CVE-2026-106017](https://www.cve.org/CVERecord?id=CVE-2026-106017)