CVE-2026-31893
Tunnelblick Symlink Following Local Privilege Escalation
Publication date: 2026-05-05
Last updated on: 2026-05-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tunnelblick | tunnelblick | From 3.3beta26 (inc) to 9.0beta01 (inc) |
| tunnelblick | tunnelblick | to 9.0beta02 (exc) |
| tunnelblick | tunnelblick | 9.0beta02 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-61 | The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-31893 is a vulnerability in Tunnelblick, an open source GUI for OpenVPN on macOS. It allows any local user to read arbitrary root-owned files without authorization by exploiting a symlink following flaw in the tunnelblick-helper component.
The vulnerability arises because the tunnelblickd Unix socket is world-accessible with mode 0666, allowing any local user to connect without authorization checks. The tunnelblick-helper process reads a config.ovpn file inside a user-controlled .tblk directory as root, but it does not validate symlinks.
An attacker can create a malicious .tblk directory containing a symlinked config.ovpn file that points to any root-owned file. When tunnelblickd reads this file, it follows the symlink and reads the target file as root, bypassing normal file permissions.
This issue affects versions 3.3beta26 through 9.0beta01 and was fixed in version 9.0beta02.
How can this vulnerability impact me? :
This vulnerability allows any local user on a macOS system running vulnerable versions of Tunnelblick to read arbitrary files owned by root without needing authentication.
An attacker could exploit this to access sensitive system files, configuration files, or credentials that are normally protected, potentially leading to information disclosure.
Since the attack does not require user interaction and leverages a world-accessible socket, it can be performed stealthily by any local user.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of the tunnelblickd Unix socket with world-accessible permissions (mode 0666) and verifying the Tunnelblick version installed on the system.
- Use the command `ls -l /path/to/tunnelblickd/socket` to check the socket permissions and confirm if it is set to 0666.
- Check the installed Tunnelblick version with `Tunnelblick --version` or by inspecting the application info to determine if it is between versions 3.3beta26 and 9.0beta01, which are vulnerable.
- Look for suspicious .tblk directories created by local users that contain symlinked config.ovpn files pointing to sensitive root-owned files.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update Tunnelblick to a patched version that addresses this vulnerability.
- Upgrade to Tunnelblick version 9.0beta02 or later, or version 8.0.1 or later, which include fixes for CVE-2026-31893.
- Verify the integrity of the update by checking the provided hashes (MD5, SHA1, SHA256) for the disk image before installation.
- Restrict permissions on the tunnelblickd Unix socket to prevent unauthorized local users from connecting.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows any local user to read arbitrary root-owned files without authorization by exploiting a symlink following flaw in Tunnelblick. This unauthorized access to sensitive system files could lead to exposure of confidential or personal data.
Such unauthorized data access may violate compliance requirements under standards like GDPR and HIPAA, which mandate strict controls on access to sensitive and personal information to protect privacy and ensure data security.
Therefore, if exploited, this vulnerability could result in non-compliance with these regulations due to improper access controls and potential data breaches.