CVE catalog
CVE-2026-75131
network-manager-l2tp: CVE-2026-75131
- Severity
- High · CVSS 8.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.18% · Oct 25, 2026
NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote character or whitespace in the username to break out of the pppd options file quoting context and include the pppd plugin directive, causing the privileged pppd process to load an attacker-controlled shared object.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | network-manager-l2tp | sid | 1.52.6-1 | fixed |
| Debian | network-manager-l2tp | forky | 1.52.6-1 | fixed |
| Debian | network-manager-l2tp | trixie | 1.20.20-2 | vulnerable |
| Debian | network-manager-l2tp | trixie-security | 1.20.20-2+deb13u1 | fixed |
| Debian | network-manager-l2tp | bookworm | 1.20.8-1 | vulnerable |
| Debian | network-manager-l2tp | bookworm-security | 1.20.8-1+deb12u1 | fixed |
| Opensuse | NetworkManager-l2tp | tumbleweed | 1.52.6-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | network-manager-l2tp | source | sid | 1.52.6-1 | not yet assigned | Not reported | Not reported |
| Debian | network-manager-l2tp | source | forky | 1.52.6-1 | not yet assigned | Not reported | Not reported |
| Debian | network-manager-l2tp | source | trixie | 1.20.20-2+deb13u1 | not yet assigned | Not reported | Not reported |
| Debian | network-manager-l2tp | source | bookworm | 1.20.8-1+deb12u1 | not yet assigned | Not reported | Not reported |
| Opensuse | NetworkManager-l2tp | rpm | tumbleweed | 1.52.6-1.1 | Not reported | OPENSUSE-SU-2026:11802-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [network-manager-l2tp]Affected
Details (2)
1.20.8-1· amd64 · bookwormAffected · Fixed:
1.20.8-1+deb12u1dsa · network-manager-l2tp · debian · bookworm; dsa · network-manager-l2tp · debian · 12
1.20.8-1· arm64 · bookwormAffected · Fixed:
1.20.8-1+deb12u1dsa · network-manager-l2tp · debian · bookworm; dsa · network-manager-l2tp · debian · 12
- [network-manager-l2tp-gnome]Affected
Source package: [network-manager-l2tp]
Details (2)
1.20.8-1· amd64 · bookwormAffected · Fixed:
1.20.8-1+deb12u1dsa · network-manager-l2tp · debian · bookworm; dsa · network-manager-l2tp · debian · 12
1.20.8-1· arm64 · bookwormAffected · Fixed:
1.20.8-1+deb12u1dsa · network-manager-l2tp · debian · bookworm; dsa · network-manager-l2tp · debian · 12
[Debian 13 (Trixie)]
- [network-manager-l2tp]Affected
Details (3)
1.20.20-2· amd64 · trixieAffected · Fixed:
1.20.20-2+deb13u1dsa · network-manager-l2tp · debian · 13
1.20.20-2· arm64 · trixieAffected · Fixed:
1.20.20-2+deb13u1dsa · network-manager-l2tp · debian · 13
1.20.20-2+deb13u1· amd64 · trixie-securityFixed · Fixed:
1.20.20-2+deb13u1dsa · network-manager-l2tp · debian · 13
- [network-manager-l2tp-gnome]Affected
Source package: [network-manager-l2tp]
Details (3)
1.20.20-2· amd64 · trixieAffected · Fixed:
1.20.20-2+deb13u1dsa · network-manager-l2tp · debian · 13
1.20.20-2· arm64 · trixieAffected · Fixed:
1.20.20-2+deb13u1dsa · network-manager-l2tp · debian · 13
1.20.20-2+deb13u1· amd64 · trixie-securityFixed · Fixed:
1.20.20-2+deb13u1dsa · network-manager-l2tp · debian · 13
[openSUSE Tumbleweed]
- [NetworkManager-l2tp]Affected
Source package: [NetworkManager-l2tp]
Details (1)
1.52.4-1.1· x86_64 · tumbleweedAffected · Fixed:
1.52.6-1.1dsa · NetworkManager-l2tp · opensuse · tumbleweed
- [NetworkManager-applet-l2tp]Unknown
Source package: [NetworkManager-l2tp]
Details (1)
1.52.4-1.1· x86_64 · tumbleweedUnknown · Fixed:
1.52.6-1.1Version impact unknown
dsa · NetworkManager-l2tp · opensuse · tumbleweed
- [NetworkManager-l2tp-lang]Unknown
Source package: [NetworkManager-l2tp]
Details (1)
1.52.4-1.1· noarch · tumbleweedUnknown · Fixed:
1.52.6-1.1Version impact unknown
dsa · NetworkManager-l2tp · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11802-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-75131]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-75131]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11802-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-75131]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75131.json]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]