{
  "cveId": "CVE-2026-31893",
  "url": "https://patchblox.com/security/cve/CVE-2026-31893",
  "summary": "CVE-2026-31893 is fixed in Tunnelblick on 1 platform by Tunnelblick 9.0.1 (version 9.0.1), released September 4, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Tunnelblick arbitrary file read via symlink following in tunnelblickd",
  "description": "Tunnelblick is an open source graphic user interface for OpenVPN on macOS. In versions 3.3beta26 through 9.0beta01, any local user can read arbitrary root-owned files by exploiting a symlink following vulnerability in tunnelblick-helper, reachable through the world-accessible tunnelblickd Unix socket. The socket is configured with mode 0666, allowing any local user to connect. No authorization check is performed on the connecting client. The tunnelblick-helper process constructs a path to config.ovpn inside a user-controlled .tblk directory and reads it as root without symlink validation. An attacker can create a .tblk configuration with a symlinked config.ovpn pointing to any file and request tunnelblickd to read it. This issue has been fixed in versions 9.0beta02.",
  "published": "2026-05-05T20:16:35Z",
  "severity": "",
  "cvss": 6.8,
  "cwe": "CWE-61: UNIX Symbolic Link (Symlink) Following",
  "epss": 0.00242,
  "epssPercentile": 0.15483,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2026-31893",
  "fixes": [
    {
      "platform": "macos",
      "product": "Tunnelblick",
      "fixedVersion": "9.0.1",
      "fix": "Tunnelblick 9.0.1",
      "url": "https://patchblox.com/security/fix/macos/net.tunnelblick.tunnelblick-9.0.1",
      "released": "2026-09-04T09:15:40Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}