CVE-2026-19624

Name	CVE-2026-19624
Description	A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-6498-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
network-manager-l2tp (PTS)	bookworm	1.20.8-1	vulnerable
	trixie	1.20.20-2	vulnerable
	trixie (security)	1.20.20-2+deb13u1	fixed
	forky	1.52.4-1	vulnerable
	sid	1.52.6-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
network-manager-l2tp	source	trixie	1.20.20-2+deb13u1		DSA-6498-1
network-manager-l2tp	source	(unstable)	1.52.6-1

Fixed by: https://github.com/nm-l2tp/NetworkManager-l2tp/commit/3704d8c9d5e5f9ed1626a8ce7627a04247cea673 (1.52.6, 1.20.26)