CVE-2026-63649
The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4.1
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
- EPSS probability
- 0.24%
- CWE
- CWE-183
- Published
- 2026-08-14
- Last modified
- 2026-08-17
Affected products
- OpenVPN OpenVPN
- OpenVPN OpenVPN
Weakness type
Related vulnerabilities
- CVE-2026-54694 — NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover
- CVE-2026-55581 — mcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` Executable
- CVE-2026-67315 — axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0
- CVE-2026-67345 — MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft
- CVE-2026-66005 — Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding
- CVE-2026-16129 — princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist
- CVE-2026-46341 — Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching
- CVE-2026-15625 — nextlevelbuilder GoClaw exec_approval.go ExecApprovalManager.CheckCommand incomplete blacklist