CVE-2026-31893: Tunnelblick Privilege Escalation Flaw

CVE-2026-31893 Overview

CVE-2026-31893 is a symlink following vulnerability [CWE-61] in Tunnelblick, an open source graphical user interface for OpenVPN on macOS. Affected versions span 3.3beta26 through 9.0beta01. Any local user can read arbitrary root-owned files by abusing the world-accessible tunnelblickd Unix socket and the tunnelblick-helper process. The socket is configured with mode 0666 and performs no authorization check on connecting clients. The helper reads config.ovpn from a user-controlled .tblk directory as root without validating symlinks. The issue is fixed in version 9.0beta02.

Critical Impact
Local users on a macOS host running Tunnelblick can read any root-owned file, including /etc/sudoers, private keys, and shadow-equivalent secrets, by planting a symlinked config.ovpn inside a .tblk bundle.

Affected Products

Tunnelblick versions 3.3beta26 through 9.0beta01
Tunnelblick tunnelblickd privileged helper component on macOS
Tunnelblick tunnelblick-helper configuration parser

Discovery Timeline

2026-05-05 - CVE-2026-31893 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-31893

Vulnerability Analysis

Tunnelblick ships a privileged background daemon, tunnelblickd, that exposes a Unix domain socket for IPC with the user-mode application. The socket is created with permissions 0666, meaning every local user account on the macOS system can connect to it. The daemon does not validate the identity of the connecting client. Once connected, an attacker can request that tunnelblick-helper parse a configuration bundle the attacker controls.

The helper builds a path to config.ovpn inside the supplied .tblk directory and opens it with root privileges. The open call follows symbolic links and does not check whether the resolved target lies outside the bundle. By placing a symlink at config.ovpn that points to any path on disk, the attacker forces the privileged helper to read that file and return its contents through the socket channel.

Root Cause

The root cause is unsafe file handling in the privileged helper combined with weak access control on the IPC channel. tunnelblickd grants world-writable access to its socket, and tunnelblick-helper resolves user-supplied paths without using O_NOFOLLOW or comparable symlink-rejecting semantics. The vulnerability is classified under [CWE-61: UNIX Symbolic Link (Symlink) Following].

Attack Vector

Exploitation requires local access and low privileges. An unprivileged user creates a .tblk directory in a writable location and replaces config.ovpn with a symbolic link to a target file such as /etc/master.passwd or a private TLS key. The attacker then connects to the tunnelblickd socket and instructs it to load the malicious bundle. The helper reads the symlink target as root and returns the contents to the attacker. No user interaction is required.

Detailed exploitation mechanics are documented in the GitHub Security Advisory GHSA-927j-vcjf-hq69.

Detection Methods for CVE-2026-31893

Indicators of Compromise

Presence of .tblk directories created by non-admin users in writable locations such as /tmp, /Users/Shared, or ~/Library.
Symbolic links named config.ovpn whose targets point outside the containing .tblk bundle.
Connections to the tunnelblickd Unix socket originating from user processes that are not the Tunnelblick GUI.

Detection Strategies

Audit Tunnelblick versions across the macOS fleet and flag any host running 3.3beta26 through 9.0beta01.
Monitor tunnelblickd process telemetry for open() syscalls on paths outside /Applications/Tunnelblick.app and outside the user's expected configuration directory.
Use Endpoint Detection and Response (EDR) telemetry to correlate non-GUI processes connecting to /var/run/tunnelblickd.socket or its configured path.

Monitoring Recommendations

Alert on creation of symlinks named config.ovpn by non-administrative users.
Log all reads of sensitive root-owned files such as /etc/sudoers, /etc/master.passwd, and /private/var/db/dslocal/nodes/Default/users performed by tunnelblick-helper.
Track unexpected child processes spawned by tunnelblickd outside normal VPN connect and disconnect flows.

How to Mitigate CVE-2026-31893

Immediate Actions Required

Upgrade Tunnelblick to version 9.0beta02 or later on all macOS endpoints.
Inventory and remove any beta builds in the affected range from managed devices.
Review filesystem locations under /tmp and user home directories for staged .tblk bundles containing symlinks.

Patch Information

The vulnerability is fixed in Tunnelblick 9.0beta02. The patched release adds symlink validation when the privileged helper opens config.ovpn and tightens handling of the IPC channel. Release notes and binaries are available on the Tunnelblick v9.0beta02 Release page.

Workarounds

Uninstall Tunnelblick on hosts where upgrading to 9.0beta02 is not yet possible.
Restrict local interactive access on shared macOS systems to trusted administrators only.
Where feasible, change the permissions on the tunnelblickd socket to restrict access to the admin group until the upgrade can be applied.

bash

# Verify installed Tunnelblick version on macOS
defaults read /Applications/Tunnelblick.app/Contents/Info.plist CFBundleVersion

# Inspect the tunnelblickd socket permissions
ls -l /var/run/tunnelblickd.socket 2>/dev/null || \
  find /private/var -name 'tunnelblickd*.socket' -ls

# Hunt for attacker-staged .tblk bundles with symlinked config.ovpn
find / -type d -name '*.tblk' 2>/dev/null -exec sh -c \
  'for d; do [ -L "$d/config.ovpn" ] && echo "SUSPECT: $d/config.ovpn -> $(readlink "$d/config.ovpn")"; done' _ {} +