PT-2026-5356 · Unknown · Trusttunnel

Megamansec · Published 2026-01-29 · Updated 2026-01-29 · CVE-2026-24904

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions TrustTunnel versions prior to 0.9.115

Description TrustTunnel, an open-source VPN protocol, has a rule bypass issue. The issue resides in the interaction between tls listener.rs and rules.rs. Specifically, the TlsListener::listen() function peeks 1024 bytes and calls extract client random(...). If parsing of the TLS plaintext fails, extract client random returns None. The RulesEngine::evaluate function only evaluates client random prefix when client random is Some(...). Consequently, when extraction fails, rules relying on client random prefix are bypassed, and evaluation proceeds to subsequent rules. The client random prefix is a match condition and does not block non-matching prefixes.

Recommendations Update to TrustTunnel version 0.9.115 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-24904

GHSA-FQH7-R5GF-3R87

Affected Products

Trusttunnel

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24904.json · Exploit
• https://github.com/TrustTunnel/TrustTunnel/security/advisories/GHSA-fqh7-r5gf-3r87 · Patch
• https://github.com/TrustTunnel/TrustTunnel/commit/aa5060145506952b9431b0ed3edb52bb6c08d9a6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24904 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24904 · Vendor Advisory
• https://twitter.com/CVEnew/status/2016992612075581653 · Twitter Post