CVE-2026-78134: High severity strongSwan Strongswan vulnerability
Last updated 21 September 2026
Other sources
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.9.14-11 - Upgrade
Upgrade
debian/strongswanto a version that resolves this vulnerability.Fixed in 6.0.1-6+deb13u7Fixed in 6.1.0-2
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Review strongSwan installations running versions 4.5.0 through 6.0.7 that use the eap-ttls or eap-peap plugins. Deployments outside that version range or not using either plugin are not identified by the available data as affected.
What level of attacker access is indicated by the severity vector?
The vector indicates network reachability is required and that the attacker needs low privileges. No user interaction is required, but exploitation is rated as having high attack complexity.
What can be done while an upgrade is pending?
Where operationally feasible, avoid using the eap-ttls and eap-peap plugins until the affected strongSwan installation can be remediated. The issue is specifically associated with those plugins.
How can an administrator determine whether a system is potentially affected?
Check the installed strongSwan version and whether eap-ttls or eap-peap is enabled or used in authentication configurations. Versions from 4.5.0 through 6.0.7 using either plugin should be treated as potentially affected.