CVE-2026-78134: 
strongSwan vulnerability analysis and mitigation

CVE-2026-78134 is an Incorrect Authorization vulnerability in strongSwan's eap-ttls and eap-peap plugins caused by missing or mismatched inner EAP identity propagation, which can result in incorrect identity binding and potential authorization bypass. It affects strongSwan versions 4.5.0 through 6.0.7 (fixed in 6.1.0). The vulnerability was disclosed on September 7, 2026, when strongSwan released version 6.1.0, and was published to NVD on September 11, 2026. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, strongSwan Release).

The root cause is classified as CWE-863 (Incorrect Authorization). In EAP-TTLS and EAP-PEAP tunneled authentication, the outer TLS tunnel establishes a protected channel within which an inner EAP method authenticates the client. The vulnerability arises because the plugins fail to properly propagate or validate the inner EAP identity against the outer identity, allowing a scenario where the authenticated inner identity is missing or mismatched — effectively decoupling the authorization decision from the actual authenticated principal. An attacker with network access and low-level credentials (e.g., a valid outer TLS session) could exploit this to impersonate another identity or bypass access controls enforced on the inner EAP identity (GitHub Advisory, strongSwan Release).

Successful exploitation allows an authenticated network attacker to bypass EAP-TTLS or EAP-PEAP authentication controls, gaining unauthorized access to VPN tunnels or protected network resources that should be restricted to specific identities. The CVSS assessment reflects high confidentiality and integrity impact (an attacker can access and potentially manipulate resources they are not authorized for) with low availability impact. In VPN environments, this could enable lateral movement into internal network segments or access to sensitive organizational resources (GitHub Advisory, strongSwan Release).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires the attacker to already hold some level of authentication (low privileges required) and involves high attack complexity, limiting opportunistic exploitation. The EPSS score is approximately 0.0032 (0.32%), indicating a low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD's SSVC assessment classifies exploitation as "none" and the attack as non-automatable (GitHub Advisory, Feedly).

The primary remediation is to upgrade strongSwan to version 6.1.0 or later, which includes the fix for CVE-2026-78134 by properly propagating authentication details from inner EAP methods to enforce correct identity binding (strongSwan Release). Organizations unable to patch immediately should review VPN access logs for suspicious authentication patterns or unexpected tunnel establishments, and consider implementing additional identity verification measures beyond EAP authentication. Prioritize patching systems actively using the eap-ttls or eap-peap plugins in production VPN environments. Patches have also been distributed via SUSE, openSUSE, Debian, Ubuntu, and FreeBSD security updates (Feedly).

The strongSwan project disclosed the vulnerability proactively as part of the 6.1.0 release on September 7, 2026, publishing a dedicated blog post at https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78134).html. Major Linux distributions including SUSE, openSUSE, Debian, and Ubuntu issued security advisories and updated packages shortly after disclosure. Microsoft also published a security advisory for the CVE. Community coverage was primarily technical and focused on patch distribution across distributions (strongSwan Release, GitHub Advisory).