CVE-2026-78134: High severity strongSwan Strongswan vulnerability
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Review strongSwan installations running versions 4.5.0 through 6.0.7 that use the eap-ttls or eap-peap plugins. Deployments outside that version range or not using either plugin are not identified by the available data as affected.
What level of attacker access is indicated by the severity vector?
The vector indicates network reachability is required and that the attacker needs low privileges. No user interaction is required, but exploitation is rated as having high attack complexity.
What can be done while an upgrade is pending?
Where operationally feasible, avoid using the eap-ttls and eap-peap plugins until the affected strongSwan installation can be remediated. The issue is specifically associated with those plugins.
How can an administrator determine whether a system is potentially affected?
Check the installed strongSwan version and whether eap-ttls or eap-peap is enabled or used in authentication configurations. Versions from 4.5.0 through 6.0.7 using either plugin should be treated as potentially affected.