{"id":"CVE-2026-19624","title":"A flaw was found in NetworkManager-l2tp","summary":"A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-88"],"vendor":"Fedora","product":"NetworkManager-l2tp","affected":["NetworkManager-l2tp >= 1.0.0 < 1.0.16","NetworkManager-l2tp >= 1.2.0 < 1.2.22","NetworkManager-l2tp >= 1.8.0 < 1.8.10","NetworkManager-l2tp >= 1.20.0 < 1.20.24","NetworkManager-l2tp >= 1.52.0 < 1.52.4","NetworkManager-l2tp >= 1.52.0 < 1.52.4","NetworkManager-l2tp >= 1.20.0 < 1.20.24"],"published":"2026-09-14","updated":"2026-09-18","sourceUpdated":"2026-09-18T19:34:36.657","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19624","references":[{"url":"https://bodhi.fedoraproject.org/updates/?packages=NetworkManager-l2tp","label":"patrick@puiterwijk.org"},{"url":"https://github.com/nm-l2tp/NetworkManager-l2tp/commit/3704d8c9d5e5f9ed1626a8ce7627a04247cea673","label":"patrick@puiterwijk.org"},{"url":"https://github.com/nm-l2tp/NetworkManager-l2tp/commit/95b6b46f48a0c9eabc79272cd313f219110ef91c","label":"patrick@puiterwijk.org"},{"url":"https://github.com/nm-l2tp/NetworkManager-l2tp/releases","label":"patrick@puiterwijk.org"},{"url":"https://linnemanlabs.com/posts/nm-l2tp-newline-to-root/","label":"patrick@puiterwijk.org"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19624.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-19624"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19624"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19624"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.0013,"epssPercentile":0.02985,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-14T19:43:22.928124Z"},"ingestedAt":"2026-09-14T20:14:21.157Z","slug":"CVE-2026-19624","body":"## Overview\n\nA flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19624.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}