Bug 2514741 (CVE-2026-19624)

Summary:	CVE-2026-19624 NetworkManager-l2tp: NetworkManager-l2tp: local privilege escalation via ipsec.conf injection
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	NetworkManager-l2tp writes attacker-controlled VPN connection properties (vpn.data / vpn.secrets values) unescaped into a generated ipsec.conf file loaded by pluto as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive, which pluto executes as root on SA establishment, resulting in local privilege escalation.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-12 14:54:26 UTC

src/nm-l2tp-service.c writes attacker-controlled vpn.data values (ipsec-ike, ipsec-esp, ipsec-group-name -> leftid, ipsec-remote-id -> rightid) into the generated /run/nm-l2tp-<uuid>/ipsec.conf with no escaping: validate_one_property() only content-checks the gateway, and write_config_option() writes the value raw.

A newline in those values injects arbitrary ipsec.conf lines into a file pluto loads as root. An injected leftupdown=<cmd> is run by pluto as root on SA establishment, resulting in local privilege escalation.

Any unprivileged local user with a local login session can AddConnection+ActivateConnection an "own" L2TP profile (polkit settings.modify.own + network-control, no admin/wheel required) and obtain root code execution. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc); the libreswan and vpnc plugins already reject newlines in these values, l2tp did not.

On default SELinux-enforcing Fedora/RHEL systems the executed code runs as uid=0 but confined to ipsec_mgmt_t (a system-binary leftupdown is required there); on non-SELinux systems it is unconfined root.

Reported via coordinated disclosure by Keith Linneman (keith). Upstream maintainer Doug fixed the issue by rejecting control characters in vpn.data/vpn.secrets string values before writing config (and similarly for env variables), released in NetworkManager-l2tp 1.52.4 (EPEL8: 1.20.24), and pushed updated packages to Fedora, EPEL, and Debian on 2026-07-05.