CVE-2026-78135: 
strongSwan vulnerability analysis and mitigation

CVE-2026-78135 is an authentication bypass vulnerability in libcharon, the core IKE daemon library of strongSwan, caused by improper handling of CREATE_CHILD_SA requests in the IKEv2 state machine. It affects strongSwan versions 5.9.7 through 6.0.7 (fixed in 6.1.0). The flaw allows an unauthenticated network attacker to create a usable Child SA before authentication completes. It carries a CVSS v3.1 base score of 7.3 (High) per NVD, and was publicly disclosed on September 11, 2026 (GitHub Advisory, strongSwan Release).

The root cause is classified as CWE-841 (Improper Enforcement of Behavioral Workflow). Specifically, libcharon's IKEv2 state machine fails to enforce the correct sequencing of authentication before allowing CREATE_CHILD_SA requests to be processed on unestablished IKE SAs. This allows an attacker to send a crafted CREATE_CHILD_SA request to a vulnerable strongSwan responder prior to completing the IKE_AUTH exchange, resulting in the creation of a functional Child SA (and thus an active IPsec tunnel) without valid credentials. The attack requires no privileges and no user interaction, and is exploitable over the network (GitHub Advisory, strongSwan Release).

Successful exploitation allows an unauthenticated remote attacker to establish an IPsec Child SA without completing authentication, effectively bypassing the VPN's access control mechanism. This can result in unauthorized access to protected network segments or communications, partial confidentiality and integrity compromise of tunneled traffic, and potential for lateral movement into internal networks that rely on strongSwan for perimeter security. Availability impact is also rated low, as the creation of spurious SAs may consume resources (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.336%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. NVD's SSVC assessment classifies exploitation as "none" and technical impact as "partial" (Feedly).

1. Reconnaissance: Identify internet-facing strongSwan VPN endpoints running versions 5.9.7 through 6.0.7 using network scanning tools (e.g., Shodan, Censys, or nmap with IKE probing scripts).
2. Initiate IKE_SA_INIT: Send a valid IKE_SA_INIT request to the target to establish the initial IKE SA negotiation context, without proceeding to IKE_AUTH.
3. Send premature CREATE_CHILD_SA: Before completing the IKE_AUTH exchange (i.e., before authentication is verified), send a crafted CREATE_CHILD_SA request referencing the partially established IKE SA.
4. Exploit state machine flaw: Due to the improper behavioral workflow enforcement in libcharon, the responder processes the CREATE_CHILD_SA request and installs a Child SA without verifying that authentication has completed.
5. Establish unauthorized tunnel: Use the resulting Child SA to route traffic through the IPsec tunnel, gaining unauthorized access to the protected network segment behind the strongSwan gateway (GitHub Advisory, strongSwan Release).

• Network: Unexpected IKEv2 CREATE_CHILD_SA exchanges observed before IKE_AUTH completion in firewall or IDS logs; new IPsec SAs established from unknown or untrusted IP addresses.
• Logs: strongSwan charon daemon logs showing Child SA creation events (CHILD_SA ... installed) without a corresponding successful IKE_SA ... authenticated log entry for the same IKE SA; unusual IKE SA state transitions in /var/log/charon.log or syslog.
• Process/State: Presence of unexpected IPsec SAs visible via ip xfrm state or ipsec statusall from IP addresses not in the configured peer list; SAs with no matching authentication record.

The strongSwan project released version 6.1.0 on September 7, 2026, which fixes CVE-2026-78135 by correcting the IKEv2 state machine handling of CREATE_CHILD_SA requests on unestablished IKE SAs (strongSwan Release). All users running strongSwan 5.9.7 through 6.0.7 should upgrade to 6.1.0 or later immediately. Distribution-specific patches are available for Debian, SUSE, openSUSE, Ubuntu (USN-8789-1), and FreeBSD. As a temporary workaround, administrators should implement network-level access controls (e.g., firewall rules) to restrict IKE/IPsec traffic (UDP 500/4500) to known, trusted peer IP addresses until patching is complete (Feedly).

The strongSwan project disclosed the vulnerability proactively via a dedicated blog post and coordinated the release of version 6.1.0 to address multiple CVEs simultaneously, including this authentication bypass (strongSwan Release). Major Linux distributions including SUSE, openSUSE, Debian, Ubuntu, and FreeBSD issued security advisories and updated packages shortly after disclosure. Coverage was noted on security aggregation sites including LinuxSecurity.com and pro-linux.de, and the vulnerability was tracked by Tenable (Nessus) and Qualys scanners.