Authentication Bypass in strongSwan Due to IKEv2 State Machine Flaw
CVE-2026-78135

5.6MEDIUM

Key Information:

Vendor

Strongswan

Status
Strongswan
Vendor
CVE Published:
11 September 2026

What is CVE-2026-78135?

A vulnerability present in strongSwan affects versions 5.9.7 to 6.0.7, where the libcharon component mismanages the behavioral workflow within the IKEv2 state machine. This mishandling can lead to improper processing of CREATE_CHILD_SA requests, resulting in potential authentication bypass. Users of affected versions should prioritize updates to mitigate these risks. For more information, visit the official strongSwan blog and GitHub release notes.

Affected Version(s)

strongSwan 5.9.7 < 6.1.0

References

https://github.com/strongswan/strongswan/releases/tag/6.1.0
https://www.strongswan.org/blog/2026/09/07/strongswan-vul...

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.