CVE-2026-78043 Overview
CVE-2026-78043 is a path traversal vulnerability [CWE-22] in the OpenVPN Windows Interactive Service. The flaw affects OpenVPN versions 2.7_alpha1 through 2.7.6 on Windows. Local authenticated users can bypass the trusted configuration directory constraint by supplying specially crafted paths. This allows loading of arbitrary configuration files outside the intended directory scope.
Critical Impact
Local authenticated attackers can load attacker-controlled OpenVPN configurations, enabling integrity attacks against VPN routing, DNS, and system state on Windows hosts.
Affected Products
- OpenVPN 2.7_alpha1 through 2.7.6 (Windows builds)
- OpenVPN Windows Interactive Service component
- Windows endpoints running vulnerable OpenVPN installations
Discovery Timeline
- 2026-09-07 - CVE-2026-78043 published to the National Vulnerability Database (NVD)
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-78043
Vulnerability Analysis
The OpenVPN Windows Interactive Service (openvpnserv.exe) runs with elevated privileges. It exposes a control channel to unprivileged users so the OpenVPN GUI can start tunnels without requiring administrator rights. To limit abuse, the service restricts configuration files to a trusted directory configured at installation time.
The vulnerability stems from insufficient path canonicalization when the service validates configuration file paths supplied by clients. An authenticated local user can craft a path that references locations outside the trusted directory. The service accepts the path and loads the configuration from the unintended location.
Because OpenVPN configuration directives can modify routing tables, DNS settings, and invoke helper scripts, loading an attacker-controlled configuration produces a high integrity impact on the host and its network state.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The Interactive Service compares supplied paths against the trusted directory string without fully canonicalizing traversal sequences, symbolic links, or alternate path representations that Windows accepts.
Attack Vector
Exploitation requires local authenticated access and user interaction on the target Windows host. The attacker sends a crafted request containing a manipulated configuration path to the Interactive Service control interface. The service resolves the path, bypasses the directory check, and loads the arbitrary configuration file the attacker controls.
See the OpenVPN Security Announcement CVE-2026-78043 for vendor technical details.
Detection Methods for CVE-2026-78043
Indicators of Compromise
- OpenVPN configuration files loaded from paths outside the configured trusted directory (typically C:\Program Files\OpenVPN\config\).
- Interactive Service log entries showing configuration requests referencing .., UNC paths, or symbolic link targets.
- Unexpected routing table modifications, DNS changes, or helper script executions initiated by openvpnserv.exe.
Detection Strategies
- Audit OpenVPN Interactive Service logs for configuration file paths that deviate from the trusted directory.
- Monitor process creation where openvpnserv.exe spawns child processes referencing unusual configuration paths.
- Correlate low-privilege user sessions with subsequent VPN configuration changes or new network interfaces.
Monitoring Recommendations
- Enable file access auditing on the OpenVPN trusted configuration directory and adjacent paths.
- Track OpenVPN version inventory across Windows endpoints to identify hosts running 2.7_alpha1 through 2.7.6.
- Alert on modifications to .ovpn files in user-writable locations that are subsequently referenced by the service.
How to Mitigate CVE-2026-78043
Immediate Actions Required
- Inventory all Windows systems running OpenVPN and identify installations in the vulnerable version range 2.7_alpha1 through 2.7.6.
- Upgrade affected hosts to a fixed OpenVPN release as published in the vendor security announcement.
- Restrict local logon rights on systems where OpenVPN is installed to reduce the pool of users who can invoke the Interactive Service.
Patch Information
OpenVPN has published a security announcement for this issue. Apply the fixed Windows build referenced in the OpenVPN Security Announcement CVE-2026-78043. Verify the installed version after upgrade using openvpn --version.
Workarounds
- Disable the OpenVPN Interactive Service on hosts where non-administrative users do not need to start VPN tunnels.
- Enforce filesystem ACLs that prevent standard users from writing .ovpn files in locations reachable by traversal.
- Restrict membership of the OpenVPN administrative group defined during installation to trusted accounts only.
# Disable the OpenVPN Interactive Service on Windows (run as Administrator)
sc.exe stop OpenVPNServiceInteractive
sc.exe config OpenVPNServiceInteractive start= disabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
