CVE-2026-19624: NetworkManager-l2tp: local privilege escalation via ipsec.conf injection
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A local unprivileged user who can create and activate their own L2TP VPN profile can exploit the flaw. Exploitation requires the user to supply crafted VPN connection properties containing a newline-injected leftupdown directive.
What component executes the injected command?
NetworkManager-l2tp writes the attacker-controlled values into a generated ipsec.conf file. Pluto loads that file as root and executes the injected command when the IKE security association is established.
How can I determine whether a system may be vulnerable?
A system may be affected if it uses NetworkManager-l2tp and permits a local unprivileged user to create and activate L2TP VPN profiles. The described attack depends on attacker-controlled vpn.data or vpn.secrets values being written unescaped into ipsec.conf.