CVE-2026-84790

Timeline

Detection, updates, and resolution for this record.

1. Oct 13, 2026 · Catalog

   Detected

   OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field

2. Oct 14, 2026 · Catalog

   Fix available

   Debian:14 openvpn 0 → 2.7.8-1

3. Oct 14, 2026 · Catalog

   Updated

   OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field

Affected

• Debian:12 openvpn2.6.11-1, 2.6.12-1, 2.6.13-1
• Debian:13 openvpn2.6.14-1, 2.6.14-1+deb13u1, 2.6.14-1+deb13u2
• Debian:14 openvpn0 → 2.7.8-1

Sources

• CVE.orgCVE-2026-84790

  Official CVE identifier

  cve.org
• NIST NVDCVE-2026-84790

  OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field

  nvd.nist.gov
• OSV.devDEBIAN-CVE-2026-84790
  osv.dev

References

• Reference · community.openvpn.net
• ADVISORY · security-tracker.debian.org