Vulnerability · Published Sep 14, 2026 · Assigned by fedora
CVE-2026-19624NetworkManager-l2tp: local privilege escalation via ipsec.conf injection
High 7.8
In plain English
A high-severity argument injection in NetworkManager-l2tp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | network-manager-l2tp | 1.20.8-1+deb12u1 | DEBIAN-CVE-2026-19624 |
| Debian:13 | network-manager-l2tp | 1.20.20-2+deb13u1 | DEBIAN-CVE-2026-19624 |
| Debian:14 | network-manager-l2tp | 1.52.6-1 | DEBIAN-CVE-2026-19624 |
| Ubuntu:22.04:LTS | network-manager-l2tp | no fix listed | UBUNTU-CVE-2026-19624 |
| Ubuntu:24.04:LTS | network-manager-l2tp | no fix listed | UBUNTU-CVE-2026-19624 |
| Ubuntu:26.04:LTS | network-manager-l2tp | no fix listed | UBUNTU-CVE-2026-19624 |
| Ubuntu:26.10 | network-manager-l2tp | no fix listed | UBUNTU-CVE-2026-19624 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NetworkManager-l2tp | 1.0.0 – before 1.0.161.2.0 – before 1.2.221.8.0 – before 1.8.101.20.0 – before 1.20.241.52.0 – before 1.52.4 | |
| Fedora | Fedora | 1.52.0 – before 1.52.4 |
| Fedora | Extra Packages for Enterprise Linux (EPEL) | 1.20.0 – before 1.20.24 |
Weakness: CWE-88 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/nm-l2tp/NetworkManager-l2tp/commit/95b6b46f48a0c9eabc79272cd313f219110ef91c patch
- https://github.com/nm-l2tp/NetworkManager-l2tp/commit/3704d8c9d5e5f9ed1626a8ce7627a04247cea673 patch
- https://github.com/nm-l2tp/NetworkManager-l2tp/releases release-notes
- https://bodhi.fedoraproject.org/updates/?packages=NetworkManager-l2tp vendor-advisory
- https://linnemanlabs.com/posts/nm-l2tp-newline-to-root/ third-party-advisory