USN-8953-1: Ubuntu patches OpenVPN user impersonation vulnerability

Ubuntu published security advisory USN-8953-1 on 22 October 2026 for the openvpn package, widely deployed on corporate VPNs and servers acting as gateways for private networks. It affects users managing remote access with client certificates: a bug in certificate subject field handling allows an authenticated user to impersonate another user.

The vulnerability

OpenVPN was found to incorrectly handle certificate subject fields. An authenticated remote user could potentially exploit this issue to impersonate other users. The reference is CVE-2026-84790.

The mechanism, described in the upstream OpenVPN project changelog, involves an embedded NUL byte in the certificate subject field: CVE-2026-84790 exploited a NUL byte embedded in the subject field to make a certificate appear as a different identity. The issue practically affected only OpenSSL-based builds, as mbedTLS already rejected this type of certificate. The upstream report bears the signature of Vivek Parikh of BreachX, with the patch written by Max Fillinger, according to OpenVPN 2.7.8 release notes.

CVE-2026-84790 affects versions from 2.3.0 to 2.7.7 on all platforms, so this is not a problem limited to recent releases: users with older OpenVPN installations are exposed nonetheless.

Fixed packages and versions

Ubuntu Release	Code name	Corrected openvpn version
26.10	stonking	2.7.7-1ubuntu1.1
26.04 LTS	resolute	2.7.0-1ubuntu1.4
24.04 LTS	noble	2.6.19-0ubuntu0.24.04.5
22.04 LTS	jammy	2.5.11-0ubuntu0.22.04.6

Source: official Ubuntu advisory USN-8953-1, published 22 October 2026.

What to do

After applying standard system updates, you must restart OpenVPN for all necessary changes to take effect. On Ubuntu:

sudo apt update && sudo apt install openvpn
sudo systemctl restart openvpn@<configuration-name>

For those who want to verify that the patch actually works and not just that the version number has been updated, the practical test is to issue a certificate with a NUL byte in the common name and attempt to authenticate: if the server accepts it, something in the build chain has not been updated correctly.

Users of Ubuntu Pro receive ten years of security coverage for over 25,000 packages in Main and Universe, free for up to 5 machines, as indicated by the Ubuntu advisory itself.