CVE-2026-78135: strongSwan IKEv2 Auth Bypass Vulnerability

CVE-2026-78135 Overview

CVE-2026-78135 is an authentication bypass vulnerability in libcharon, the IKE daemon component of strongSwan. The flaw affects strongSwan versions 5.9.7 through 6.0.7 and stems from mishandling of the behavioral workflow in the Internet Key Exchange version 2 (IKEv2) state machine. Specifically, CREATE_CHILD_SA requests are processed incorrectly, allowing an attacker to bypass authentication controls. Because strongSwan is widely deployed as a VPN gateway and IPsec endpoint across enterprise and cloud environments, the vulnerability exposes affected systems to unauthorized tunnel establishment. The issue is classified under [CWE-841: Improper Enforcement of Behavioral Workflow].

Critical Impact

Network-adjacent attackers can bypass IKEv2 authentication by exploiting mishandled CREATE_CHILD_SA exchanges, potentially compromising the confidentiality and integrity of IPsec tunnels.

Affected Products

• strongSwan 5.9.7 through 5.9.x
• strongSwan 6.0.0 through 6.0.7
• libcharon IKE daemon component

Discovery Timeline

• 2026-09-07 - strongSwan project publishes vulnerability advisory blog post
• 2026-09-11 - CVE-2026-78135 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-78135

Vulnerability Analysis

The vulnerability resides in libcharon, the IKEv2 daemon that manages security association (SA) negotiation in strongSwan. IKEv2 uses a defined state machine to sequence exchanges: IKE_SA_INIT establishes cryptographic parameters, IKE_AUTH performs peer authentication, and CREATE_CHILD_SA creates or rekeys child SAs for data traffic.

In affected strongSwan versions, the daemon mishandles the behavioral workflow governing CREATE_CHILD_SA requests. The state machine fails to correctly enforce that authentication has completed and remains valid before processing these requests. This creates an opportunity for an attacker to induce the daemon into establishing or manipulating child SAs without satisfying the required authentication state.

The result is an authentication bypass affecting confidentiality, integrity, and availability of the IPsec tunnel. Attackers on the network path do not need credentials or user interaction to trigger the flawed code path.

Root Cause

The root cause is improper enforcement of behavioral workflow [CWE-841] within the IKEv2 state machine implementation. The daemon accepts and processes CREATE_CHILD_SA requests in states where authentication constraints should reject them. Refer to the strongSwan Blog CVE-2026-78135 Analysis for a full protocol-level breakdown.

Attack Vector

Exploitation requires network reachability to the strongSwan IKE endpoint, typically UDP port 500 or 4500. The attacker sends crafted IKEv2 messages that manipulate the state machine into processing CREATE_CHILD_SA requests without a valid authenticated context. No privileges or user interaction are required.

Refer to the strongSwan 6.1.0 release notes for the exact protocol conditions addressed by the fix.

Detection Methods for CVE-2026-78135

Indicators of Compromise

• Unexpected CREATE_CHILD_SA exchanges appearing in charon logs without a preceding successful IKE_AUTH
• IPsec child SAs established from unknown or unauthorized peer identities
• Anomalous IKEv2 negotiation patterns on UDP port 500 or 4500 from untrusted networks
• Increased volume of IKEv2 traffic targeting VPN gateways running vulnerable strongSwan versions

Detection Strategies

• Enable verbose logging in strongswan.conf for the ike, cfg, and chd subsystems to capture state transitions
• Correlate CREATE_CHILD_SA events with prior IKE_AUTH completion for the same IKE SA identifier
• Deploy network intrusion detection signatures that flag malformed or out-of-sequence IKEv2 messages
• Compare installed strongSwan version against the affected range (5.9.7 through 6.0.7) across VPN gateways

Monitoring Recommendations

• Continuously inventory strongSwan versions across VPN concentrators and IPsec endpoints
• Monitor firewall and NetFlow data for IKEv2 traffic from unexpected source addresses
• Alert on repeated IKE SA establishment failures followed by successful child SA creation
• Track charon daemon restarts and configuration reloads for signs of manipulation

How to Mitigate CVE-2026-78135

Immediate Actions Required

• Upgrade strongSwan to version 6.1.0 or later, which contains the fix for the IKEv2 state machine handling
• Inventory all systems running libcharon versions between 5.9.7 and 6.0.7 and prioritize internet-facing VPN gateways
• Restrict inbound IKEv2 traffic (UDP 500 and 4500) to known peer addresses where operationally feasible
• Review IPsec tunnel and child SA logs for signs of unauthorized establishment prior to patching

Patch Information

The strongSwan project addressed CVE-2026-78135 in release 6.1.0. Administrators should install the fixed version from the GitHub StrongSwan Release 6.1.0 page or apply distribution-provided backports. Full technical details are available in the strongSwan Blog CVE-2026-78135 Analysis.

Workarounds

• Apply strict source-address filtering on VPN gateways to limit exposure of the IKE daemon
• Enforce certificate-based peer authentication and disable weak authentication methods in swanctl.conf
• Place strongSwan endpoints behind IPsec-aware firewalls that validate IKEv2 message sequencing
• Disable unused IKEv2 features and configuration profiles to reduce exposed state machine transitions

# Verify installed strongSwan version
strongswan version

# Example: restrict IKE traffic to trusted peers (iptables)
iptables -A INPUT -p udp --dport 500 -s <trusted_peer_ip> -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -s <trusted_peer_ip> -j ACCEPT
iptables -A INPUT -p udp --dport 500 -j DROP
iptables -A INPUT -p udp --dport 4500 -j DROP