CVE-2026-24904
📋 TL;DR
TrustTunnel VPN protocol versions before 0.9.115 have a rule bypass vulnerability where fragmented or partial TLS ClientHello messages cause client random extraction to fail. When this happens, security rules that rely on client_random_prefix matching are skipped, potentially allowing unauthorized connections. This affects anyone using TrustTunnel with rule-based access controls.
💻 Affected Systems
- TrustTunnel
📦 What is this software?
Trusttunnel by Adguard
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass authentication rules and gain unauthorized VPN access to protected networks, potentially leading to data exfiltration or lateral movement.
Likely Case
Inconsistent rule enforcement allowing some unauthorized connections through the VPN gateway when fragmented packets occur.
If Mitigated
Limited impact with proper network segmentation and additional authentication layers beyond TrustTunnel rules.
🎯 Exploit Status
Requires ability to send fragmented TLS ClientHello packets to trigger the extraction failure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.9.115
Vendor Advisory: https://github.com/TrustTunnel/TrustTunnel/security/advisories/GHSA-fqh7-r5gf-3r87
Restart Required: Yes
Instructions:
1. Stop TrustTunnel service. 2. Update to version 0.9.115 or later. 3. Restart TrustTunnel service. 4. Verify rules are functioning correctly.
🔧 Temporary Workarounds
Network filtering
allUse network firewalls or IDS/IPS to detect and block fragmented TLS ClientHello packets.
Rule redundancy
allAdd redundant rules that don't rely on client_random_prefix to catch unauthorized connections.
🧯 If You Can't Patch
- Implement network segmentation to limit potential damage from unauthorized VPN connections
- Add additional authentication layers (MFA, certificate-based auth) beyond TrustTunnel rules
🔍 How to Verify
Check if Vulnerable:
Check TrustTunnel version: if version < 0.9.115 and using client_random_prefix rules, system is vulnerable.Check Version:
trusttunnel --versionVerify Fix Applied:
After patching, test with fragmented ClientHello packets and verify rules are still enforced.📡 Detection & Monitoring
Log Indicators:
- Failed client_random extraction logs
- Rule evaluation skipping due to None client_random
- Unexpected successful connections bypassing rules
Network Indicators:
- Fragmented TLS ClientHello packets to TrustTunnel port
- Connection attempts that should be blocked by rules but succeed
SIEM Query:
source="trusttunnel" AND ("extract_client_random failed" OR "client_random is None" OR "rule skipped")