The long and short is that OpenVPN has a way to execute arbitrary system commands at whatever privileges the OpenVPN daemon has (usually pretty high) via a conf

The long and short is that OpenVPN has a way to execute arbitrary system commands at whatever privileges the OpenVPN daemon has (usually pretty high) via a config file. Treat OpenVPN config files the same way you'd treat a bash script you pulled from the net and were thinking of running as root. IE: read the damn thing first.