Tunnelblick arbitrary file read via symlink following in tunnelblickd
CVE-2026-31893 is fixed in Tunnelblick on 1 platform by Tunnelblick 9.0.1 (version 9.0.1), released September 4, 2026. It is not reported as exploited. Patch Radar priority: Routine.
Tunnelblick is an open source graphic user interface for OpenVPN on macOS. In versions 3.3beta26 through 9.0beta01, any local user can read arbitrary root-owned files by exploiting a symlink following vulnerability in tunnelblick-helper, reachable through the world-accessible tunnelblickd Unix socket. The socket is configured with mode 0666, allowing any local user to connect. No authorization check is performed on the connecting client. The tunnelblick-helper process constructs a path to config.ovpn inside a user-controlled .tblk directory and reads it as root without symlink validation. An attacker can create a .tblk configuration with a symlinked config.ovpn pointing to any file and request tunnelblickd to read it. This issue has been fixed in versions 9.0beta02.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| macOS | |||
| Tunnelblick | 9.0.1 | Tunnelblick 9.0.1 | Sep 4, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.