A flaw was found in NetworkManager-l2tp. (CVE-2026-19624)
CVE-2026-19624 is a local privilege escalation vulnerability in NetworkManager-l2tp. It occurs because the plugin writes attacker-controlled VPN connection properties unescaped into the ipsec.conf file, which is loaded by pluto running as root. A local unprivileged user can exploit this by injecting newline characters into the VPN profile, causing arbitrary commands to execute with root privileges.
AI Analysis
Technical Summary
The vulnerability in NetworkManager-l2tp arises from improper escaping of vpn.data and vpn.secrets values when generating the ipsec.conf file. Since pluto loads this file as root, a local attacker can craft an L2TP VPN profile with newline-injected directives, specifically the leftupdown directive, which pluto executes as root upon establishing the IKE security association. This leads to local privilege escalation. The flaw is of the same class as CVE-2018-10900 affecting NetworkManager-vpnc and is categorized under CWE-88 (Improper Neutralization of Argument Delimiters in a Command).
Potential Impact
A local unprivileged user can escalate their privileges to root by exploiting this vulnerability. The attacker can execute arbitrary commands with root privileges during the VPN connection setup, potentially compromising the entire system's security.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to trusted users only and avoid activating untrusted L2TP VPN profiles.
A flaw was found in NetworkManager-l2tp. (CVE-2026-19624)
Description
CVE-2026-19624 is a local privilege escalation vulnerability in NetworkManager-l2tp. It occurs because the plugin writes attacker-controlled VPN connection properties unescaped into the ipsec.conf file, which is loaded by pluto running as root. A local unprivileged user can exploit this by injecting newline characters into the VPN profile, causing arbitrary commands to execute with root privileges.
CVSS v3.1
Score 7.8high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in NetworkManager-l2tp arises from improper escaping of vpn.data and vpn.secrets values when generating the ipsec.conf file. Since pluto loads this file as root, a local attacker can craft an L2TP VPN profile with newline-injected directives, specifically the leftupdown directive, which pluto executes as root upon establishing the IKE security association. This leads to local privilege escalation. The flaw is of the same class as CVE-2018-10900 affecting NetworkManager-vpnc and is categorized under CWE-88 (Improper Neutralization of Argument Delimiters in a Command).
Potential Impact
A local unprivileged user can escalate their privileges to root by exploiting this vulnerability. The attacker can execute arbitrary commands with root privileges during the VPN connection setup, potentially compromising the entire system's security.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to trusted users only and avoid activating untrusted L2TP VPN profiles.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-4533-c5f5-j3h9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-19624"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6aa8a1c755bf5e2cf5f3e8db
Added to database: 09/15/2026, 01:39:19 UTC
Last enriched: 09/15/2026, 01:58:43 UTC
Last updated: 09/15/2026, 07:08:18 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.