CVE-2026-41070 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-41070 requires immediate attention.

· 3 min read

```html

Executive Summary

A critical vulnerability (CVE-2026-41070) has been identified in the openvpn-auth-oauth2 plugin when deployed in experimental mode. This flaw allows unauthenticated clients, specifically those not supporting WebAuth/SSO, to gain full access to the VPN, bypassing authentication mechanisms. Immediate action is required to mitigate potential risks.

Immediate Action

  • Upgrade to version 1.27.3 or later of openvpn-auth-oauth2 to close the vulnerability.
  • If unable to upgrade, switch to the default management client mode, which is not affected.
  • Restrict VPN access to clients known to support WebAuth/SSO, though this is not a reliable long-term solution.
  • Monitor for updates from the vendor regarding further security advisories.
  • Review and restrict network access to minimize exposure until the patch is applied.

Affected Versions

  • openvpn-auth-oauth2@1.26.3 to 1.27.2 vulnerable; upgrade to 1.27.3+

Resolution Guide

To patch the vulnerability, execute the following commands based on your environment:

go get github.com/jkroepke/openvpn-auth-oauth2@v1.27.3

For Docker users, update your Dockerfile to:

FROM jkroepke/openvpn-auth-oauth2:v1.27.3

To ensure your configuration is secure, consider the following:

  • Disable experimental plugin mode if currently in use.

Example of a minimal patch snippet:

case management.ClientAuthDeny:
    // Correctly deny access
    return c.OpenVPNPluginFuncError  // Ensure clients are rejected

Detection & Verification

To check if your installation is vulnerable, run:

go list -m all | grep openvpn-auth-oauth2

To verify that you have successfully patched the vulnerability, confirm the version:

go list -m github.com/jkroepke/openvpn-auth-oauth2

Risk and Impact

This vulnerability poses a critical risk, allowing unauthorized clients to connect to your VPN without proper authentication, potentially exposing sensitive internal networks. The blast radius includes any network accessible via the VPN, making it imperative to act swiftly to secure your deployment.

```

Keep reading