CVE-2026-19624: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-19624 is a local privilege escalation vulnerability in NetworkManager-l2tp, the L2TP VPN plugin for NetworkManager. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that the Libreswan pluto daemon loads as root. A local unprivileged user can inject a newline character into a VPN profile property (e.g., the leftupdown directive), causing pluto to execute an arbitrary command as root when the IKE security association is established. Affected versions span multiple release branches: 1.0.x before 1.0.16, 1.2.x before 1.2.22, 1.8.x before 1.8.10, 1.20.x before 1.20.24, and 1.52.x before 1.52.4. The vulnerability has a CVSS v3.1 base score of 7.8 (High) (Feedly, GitHub Releases).

The root cause is improper neutralization of argument delimiters (CWE-88) — specifically, the failure to strip or reject newline and other control characters from user-supplied VPN connection properties before writing them into the ipsec.conf configuration file. Because the file is parsed line-by-line by pluto running as root, an injected newline allows an attacker to introduce arbitrary new directives, most critically leftupdown=<command>, which pluto executes as a shell command upon IKE SA establishment. The fix, applied in commits 95b6b46 and 3704d8c, adds a string_contains_control_char() check that rejects any property value containing ASCII control characters (including \n) in username fields, VPN data items, secrets, and the PLUTODEBUG/CHARONDEBUG environment variables. This vulnerability is in the same bug class as CVE-2018-10900, which affected NetworkManager-vpnc via an identical newline-injection pattern (GitHub Commit 95b6b46, GitHub Commit 3704d8c).

Successful exploitation grants a local unprivileged user full root-level code execution on the affected system, resulting in complete compromise of confidentiality, integrity, and availability. An attacker can read sensitive files (e.g., /etc/shadow, private keys), modify system configuration, install persistent backdoors, or use the compromised host as a pivot point for lateral movement within the network. The impact is scoped to the local machine but is total once exploited (Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only low privileges (a local user account) and no user interaction, making it straightforward for any local attacker on an affected system with the NetworkManager-l2tp plugin installed and Libreswan configured (Feedly).

1. Gain local access: Obtain a low-privileged local user account on a Linux system with NetworkManager-l2tp installed and Libreswan (pluto) as the IPsec backend.
2. Create a malicious VPN profile: Using NetworkManager's D-Bus API or nmcli, create a new L2TP VPN connection profile. Set a VPN data property (e.g., ipsec-remote-id) to a value containing a newline followed by a malicious directive, such as value\nleftupdown=/tmp/evil.sh.
3. Prepare the payload: Place an executable script at the injected path (e.g., /tmp/evil.sh) that performs the desired privileged action, such as adding a backdoor user or copying /etc/shadow.
4. Activate the VPN connection: Trigger the VPN connection via nmcli connection up <profile-name> or the NetworkManager GUI. The plugin writes the unescaped property into /run/nm-l2tp-<pid>/ipsec.conf.
5. Achieve root execution: When pluto loads the generated ipsec.conf and establishes the IKE security association, it reads the injected leftupdown directive and executes the specified command as root, completing the privilege escalation (GitHub Commit 95b6b46, Feedly).

• File System: Unexpected or newly created files in /tmp or world-writable directories that are executable and owned by a non-root user; presence of unusual scripts referenced in /run/nm-l2tp-*/ipsec.conf.
• Logs: Review /run/nm-l2tp-*/ipsec.conf for lines containing leftupdown pointing to unexpected paths; NetworkManager logs (journalctl -u NetworkManager) showing VPN connection activation by a non-privileged user followed by unexpected root-level process spawning.
• Process: Unusual processes spawned as root that are children of pluto or ipsec, such as shell scripts, curl, wget, nc, or user-management commands (useradd, passwd).
• Network: Unexpected outbound connections from the host shortly after a VPN connection activation event, potentially indicating a reverse shell or data exfiltration payload executed via leftupdown.

Upgrade NetworkManager-l2tp to a patched release: 1.0.16, 1.2.22, 1.8.10, 1.20.24, or 1.52.4 (or later). Fedora users should apply updates via Bodhi (bodhi.fedoraproject.org). No configuration-based workaround is available; the only effective remediation is upgrading to a fixed version. As an interim measure, restrict local user access to NetworkManager's VPN connection management via polkit policies to limit who can create and activate VPN profiles (GitHub Releases, Fedora Bodhi).

The vulnerability was noted as belonging to the same bug class as CVE-2018-10900 (NetworkManager-vpnc), highlighting a recurring pattern of newline-injection flaws in NetworkManager VPN plugins. A technical write-up was published at linnemanlabs.com detailing the exploitation mechanics. No major vendor statements or widespread media coverage beyond standard vulnerability tracking databases have been identified (Feedly).