CVE-2026-19624

A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).

• CWE-88

• https://bodhi.fedoraproject.org/updates/?packages=NetworkManager-l2tp
• https://github.com/nm-l2tp/NetworkManager-l2tp/commit/3704d8c9d5e5f9ed1626a8ce7627a04247cea673
• https://github.com/nm-l2tp/NetworkManager-l2tp/commit/95b6b46f48a0c9eabc79272cd313f219110ef91c
• https://github.com/nm-l2tp/NetworkManager-l2tp/releases
• https://linnemanlabs.com/posts/nm-l2tp-newline-to-root/

Published

Sep 14, 2026

Last Modified

Sep 14, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19614The API is prone to XML external entity (XXE) injection. By …5.3
• CVE-2026-19615The Admin and Site Enhancements (ASE) WordPress plugin befor…6.8
• CVE-2026-19616Missing Authorization vulnerability in TBC Technology Inc. K…7.5
• CVE-2026-19617A flaw was found in libdm. A local attacker could craft a ma…5.5
• CVE-2026-19619GitLab has remediated an issue in GitLab CE/EE affecting all…4.7
• CVE-2026-1962A vulnerability has been found in WeKan up to 8.20. The impa…9.8
• CVE-2026-19625When a Quarkus application has multiple endpoints secured by…5.3
• CVE-2026-19626A remote code execution vulnerability exists in Tenable Secu…9.9
• CVE-2026-19628A command injection vulnerability exists in Tenable Security…7.2
• CVE-2026-19629A privilege escalation vulnerability exists in Tenable Secur…8.1
• CVE-2026-1963A vulnerability was found in WeKan up to 8.20. This affects …9.8
• CVE-2026-19631A SQL injection vulnerability exists in Security Center that…4.9