CVE-2026-19624
- Source
- https://cve.org/CVERecord?id=CVE-2026-19624
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19624.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-19624
- Downstream
- Published
- 2026-09-14T19:19:43Z
- Modified
- 2026-10-28T02:56:23Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- NetworkManager-l2tp: local privilege escalation via ipsec.conf injection
- Details
-
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).
- Database specific
{ "cna_assigner": "fedora", "cwe_ids": [ "CWE-88" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19624.json" }- References
-
- https://bodhi.fedoraproject.org/updates/?packages=NetworkManager-l2tp
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19624.json
- https://github.com/nm-l2tp/NetworkManager-l2tp/releases
- https://linnemanlabs.com/posts/nm-l2tp-newline-to-root/
- https://nvd.nist.gov/vuln/detail/CVE-2026-19624
- https://github.com/nm-l2tp/NetworkManager-l2tp/commit/3704d8c9d5e5f9ed1626a8ce7627a04247cea673
- https://github.com/nm-l2tp/NetworkManager-l2tp/commit/95b6b46f48a0c9eabc79272cd313f219110ef91c
- https://github.com/nm-l2tp/NetworkManager-l2tp
Affected packages
Git / github.com/nm-l2tp/networkmanager-l2tp
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nm-l2tp/networkmanager-l2tp
- Events
-
IntroducedFixedIntroduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixedIntroducedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "1.0.0" }, { "fixed": "1.0.16" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "1.2.0" }, { "fixed": "1.2.22" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "1.8.0" }, { "fixed": "1.8.10" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "1.20.0" }, { "fixed": "1.20.24" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "1.52.0" }, { "fixed": "1.52.4" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "95b6b46f48a0c9eabc79272cd313f219110ef91c" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "3704d8c9d5e5f9ed1626a8ce7627a04247cea673" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
0.*
0.1
0.2
0.3.0
0.3.1
0.3.2
0.3.3
0.9.4
0.9.6
0.9.8
0.9.8.4
0.9.8.5
0.9.8.6
0.9.8.7
1.*
1.0.0
1.0.10
1.0.12
1.0.14
1.0.2
1.0.4
1.0.6
1.0.8
1.2.10
1.2.12
1.2.14
1.2.16
1.2.18
1.2.20
1.2.4
1.2.6
1.2.8
1.20.0
1.20.10
1.20.12
1.20.14
1.20.16
1.20.18
1.20.2
1.20.20
1.20.22
1.20.4
1.20.6
1.20.8
1.52.0
1.52.2
1.8.0
1.8.2
1.8.4
1.8.6
1.8.8