CVE-2026-19624
NetworkManager-l2tp: local privilege escalation via ipsec.conf injection
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).
| CWE | CWE-88 |
| Published | Sep 14, 2026 |
| Last Updated | Sep 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for
Be the first to know when new high vulnerabilities are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Fedora / Fedora
1.52.0 < 1.52.4
Fedora / Extra Packages for Enterprise Linux (EPEL)
1.20.0 < 1.20.24
References
github.com: https://github.com/nm-l2tp/NetworkManager-l2tp/commit/95b6b46f48a0c9eabc79272cd313f219110ef91c github.com: https://github.com/nm-l2tp/NetworkManager-l2tp/commit/3704d8c9d5e5f9ed1626a8ce7627a04247cea673 github.com: https://github.com/nm-l2tp/NetworkManager-l2tp/releases bodhi.fedoraproject.org: https://bodhi.fedoraproject.org/updates/?packages=NetworkManager-l2tp linnemanlabs.com: https://linnemanlabs.com/posts/nm-l2tp-newline-to-root/
Credits
Keith Linneman (Linneman Labs)