CVE-2026-78134
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
strongSwan 4.5.0 through 6.0.7 has incorrect access control in the eap-ttls and eap-peap plugins because the inner EAP identity may be missing or mismatched.
Risk Assessment
An attacker could bypass access controls and gain unauthorized VPN access by impersonating another identity.
Recommendation
Update strongSwan to a version newer than 6.0.7 once available, or enable additional verification of the inner EAP identity.
Other vulnerabilities in strongSwan
See all- CVE-2017-9023High
The ASN.1 parser in strongSwan before version 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, allowing remote attackers to cause a denial of service (infinite loop) via a crafted certificate.
- CVE-2015-3991Critical
strongSwan versions 5.2.2 and 5.3.0 allow remote attackers to cause a denial of service (daemon crash) or execute arbitrary code.
- CVE-2026-78135Medium
libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an authentication bypass.
- CVE-2026-78133High
libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.
- CVE-2026-78132High
strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.
- CVE-2026-78131Low
strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser.
- CVE-2026-78130High
strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.
- CVE-2026-78129Medium
strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.
- CVE-2026-78127Low
libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.
- CVE-2026-78126Medium
strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin.
Original NVD description (English source)
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity.