CVE-2026-106017 - OpenVPN 3 Core - remote-cert-tls from a profile silently discarded

Improper certificate validation in the profile option parser (KUParse) of the OpenVPN 3 Core library 3.4 through 3.11.7 allows man-in-the-middle attackers holding any certificate issued by the client's configured CA to impersonate the VPN server via a certificate lacking a serverAuth extended key usage, because remote-cert-tls from a client profile is silently discarded during configuration load.

Fixed in OpenVPN 3 Core Library v3.11.8.

CVE record: CVE-2026-106017