CVE-2026-31893: Tunnelblick arbitrary file read via symlink following in tunnelblickd

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-05-05 · updated 2026-07-25
Weakness: CWE-61

Description

Tunnelblick is an open source graphic user interface for OpenVPN on macOS. In versions 3.3beta26 through 9.0beta01, any local user can read arbitrary root-owned files by exploiting a symlink following vulnerability in tunnelblick-helper, reachable through the world-accessible tunnelblickd Unix socket. The socket is configured with mode 0666, allowing any local user to connect. No authorization check is performed on the connecting client. The tunnelblick-helper process constructs a path to config.ovpn inside a user-controlled .tblk directory and reads it as root without symlink validation. An attacker can create a .tblk configuration with a symlinked config.ovpn pointing to any file and request tunnelblickd to read it. This issue has been fixed in versions 9.0beta02.

Affected products

Tunnelblick: from 3.5.3 before 8.0.1; 3.3-beta26, 8.1-beta01, 8.1-beta02, 8.1-beta03, 9.0-beta01 — fixed in 8.0.1

How to fix

Upgrade to a fixed version: Tunnelblick 8.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-31893 or the next vulnerability affects your stack