CVE-2026-78134

strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity.

Database specific

{
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78134.json"
}

References

Affected packages

Git / github.com/strongswan/strongswan

Affected ranges

Type

GIT

Repo

https://github.com/strongswan/strongswan

Events

Introduced

327aa0c0120feef11c5a4bdba77a7d26875c9e60

Fixed

b43f6bfeed34b4afc8a7eb0c0de38e6e70177847

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "4.5.0"
        },
        {
            "fixed": "6.1.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

4.*

4.5.0

4.5.1

4.5.2

4.5.3

4.6.0

4.6.1

4.6.2

4.6.3

5.*

5.0.0

5.0.1

5.0.2

5.0.2dr4

5.0.2rc1

5.0.3

5.0.3dr1

5.0.3dr2

5.0.3dr3

5.0.3rc1

5.0.4

5.1.0

5.1.0dr1

5.1.0dr2

5.1.0rc1

5.1.1

5.1.1dr1

5.1.1dr2

5.1.1dr3

5.1.1dr4

5.1.1rc1

5.1.2

5.1.2.dr2

5.1.2dr1

5.1.2dr3

5.1.2rc1

5.1.2rc2

5.1.3

5.1.3dr1

5.1.3rc1

5.2.0

5.2.0dr1

5.2.0dr2

5.2.0dr3

5.2.0dr4

5.2.0dr5

5.2.0dr6

5.2.0rc1

5.2.1

5.2.1dr1

5.2.1rc1

5.2.2

5.2.2dr1

5.2.2rc1

5.3.0

5.3.0dr1

5.3.0rc1

5.3.1

5.3.1dr1

5.3.1rc1

5.3.2

5.3.3

5.3.3dr1

5.3.3dr3

5.3.3dr4

5.3.3dr5

5.3.3dr6

5.3.3rc2

5.3.4

5.3.4dr1

5.3.4dr2

5.3.4dr3

5.3.4rc1

5.3.5

5.4.0

5.4.0dr1

5.4.0dr2

5.4.0dr3

5.4.0dr4

5.4.0dr5

5.4.0dr6

5.4.0dr7

5.4.0dr8

5.4.0rc1

5.4.1dr1

5.4.1dr2

5.4.1dr3

5.4.1dr4

5.5.0

5.5.0dr1

5.5.0rc1

5.5.1

5.5.1dr1

5.5.1dr2

5.5.1dr3

5.5.1dr4

5.5.1dr5

5.5.1rc1

5.5.1rc2

5.5.2

5.5.2dr1

5.5.2dr2

5.5.2dr3

5.5.2dr4

5.5.2dr5

5.5.2dr6

5.5.2dr7

5.5.2rc1

5.5.3

5.5.3dr1

5.5.3dr2

5.6.0

5.6.0dr1

5.6.0dr2

5.6.0dr3

5.6.0dr4

5.6.0rc1

5.6.0rc2

5.6.1

5.6.1dr1

5.6.1dr2

5.6.1dr3

5.6.1rc1

5.6.2

5.6.2dr1

5.6.2dr2

5.6.2dr3

5.6.2dr4

5.6.2rc1

5.6.3

5.6.3dr1

5.6.3dr2

5.6.3rc1

5.7.0

5.7.0dr1

5.7.0dr2

5.7.0dr3

5.7.0dr4

5.7.0dr5

5.7.0dr6

5.7.0dr8

5.7.0rc1

5.7.0rc2

5.7.1

5.7.2

5.7.2dr1

5.7.2dr2

5.7.2dr3

5.7.2dr4

5.7.2rc1

5.8.0

5.8.0dr2

5.8.0rc1

5.8.1

5.8.1dr1

5.8.1rc2

5.8.2

5.8.2dr1

5.8.2dr2

5.8.2rc1

5.8.2rc2

5.8.3

5.8.3rc1

5.8.4

5.9.0

5.9.0dr1

5.9.0dr2

5.9.0rc1

5.9.1

5.9.10

5.9.10rc1

5.9.11

5.9.11dr1

5.9.11dr2

5.9.11dr3

5.9.11rc1

5.9.12

5.9.12dr1

5.9.12dr2

5.9.12rc1

5.9.13

5.9.13rc1

5.9.14

5.9.14dr1

5.9.14rc1

5.9.1dr1

5.9.1rc1

5.9.2

5.9.2dr1

5.9.2dr2

5.9.2rc1

5.9.2rc2

5.9.3

5.9.3dr1

5.9.3dr2

5.9.3dr3

5.9.3dr4

5.9.3rc1

5.9.4

5.9.4dr1

5.9.4dr2

5.9.4dr3

5.9.4rc1

5.9.5

5.9.5dr1

5.9.5dr2

5.9.5dr3

5.9.5dr4

5.9.5rc1

5.9.6

5.9.6rc1

5.9.7

5.9.7dr1

5.9.7dr2

5.9.7rc1

5.9.8

5.9.8dr1

5.9.8dr2

5.9.8dr3

5.9.8dr4

5.9.8rc1

5.9.9

5.9.9rc1

5.9.9rc2

6.*

6.0.0

6.0.0rc1

6.0.0rc2

6.0.1

6.0.1rc1

6.0.2

6.0.2dr1

6.0.2dr2

6.0.2dr3

6.0.2rc1

6.0.3

6.0.3dr1

6.0.3rc1

6.0.4

6.0.4rc1

6.0.5

6.0.5dr1

6.0.6

6.0.7

6.1.0rc1

android-2.*

android-2.3.3

android-2.3.3-1

android-2.4.0

android-2.4.1

android-2.4.1-1

android-2.4.2

android-2.5.0

android-2.5.1

android-2.5.2

android-2.5.3

android-2.5.4

android-2.5.5

android-2.5.6

android-2.6.0

android-2.6.1

android-2.6.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78134.json"