Quick answers
- Is CVE-2026-78134 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78134 being exploited in the wild.
- How severe is CVE-2026-78134?
- High severity, with a CVSS score of 7.1, published 11 September 2026.
- Which products and versions are affected?
- strongSwan 4.5.0 through 6.0.7.
- Is there a fix for CVE-2026-78134?
- A patch was published on 2026-09-07: Fixed in version 6.1.0 released 2026-09-07 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78134 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-78134?
- Check whether you run strongSwan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an incorrect access control issue in the eap-peap and eap-ttls plugins where the inner EAP method's identity is not properly propagated to the outer IKE/EAP identity, or a mismatch occurs between them. The root cause is that the IKE/EAP identity—which is used for critical authorization decisions including configuration selection, uniqueness checks, and virtual IP assignment—may not match the authenticated inner EAP identity. An attacker with valid credentials can exploit this by claiming a different identity during the initial EAP-Identity exchange while authenticating with their own credentials in the tunneled inner EAP method. The attack requires the attacker to have valid authentication credentials and EAP-PEAP or EAP-TTLS to be enabled on the server. The fix is included in strongSwan 6.1.0 and patches are available for versions 5.3.0 and newer.
Affected products
- strongSwan strongSwan 4.5.0 through 6.0.7
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Fixed in version 6.1.0 released 2026-09-07