CVE-2026-78135 Auth bypass in strongSwan
Attackers can bypass authentication in strongSwan's IKEv2 state machine by mishandling CREATE_CHILD_SA requests, compromising VPN security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-78135?
CVE-2026-78135 is a medium-severity authentication bypass vulnerability in strongSwan, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an authentication bypass.
Weakness: CWE-841
Which versions are affected by CVE-2026-78135?
It affects 1 product.
Products include Strongswan Strongswan.
How do I fix CVE-2026-78135?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-78135 being exploited?
There is no known exploitation of CVE-2026-78135 in the wild and no public exploit code.
Other vulnerabilities in strongSwan
Sources
Also known as AZL-100049, DEBIAN-CVE-2026-78135, GHSA-937c-856w-w843, MINI-6gqf-cxmc-5jfv, UBUNTU-CVE-2026-78135.