PT-2026-20491 · Strongman+1 · Strongman+1

Tobiasbrunner · Published 2026-02-18 · Updated 2026-02-23 · CVE-2026-25998

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions strongMan versions prior to 0.2.0

Description strongMan, a management interface for strongSwan, improperly encrypted credentials stored in its database. The software used AES in CTR mode with a global database key and a consistent initialization vector (IV) for all database fields. This allowed an attacker with database access to recover encrypted credentials, including certificates, ECDSA private keys, and EAP secrets. Because certificates are considered public information, an attacker could recover a significant portion of the key stream, facilitating decryption of other sensitive data. The API endpoint used for credential storage was not specified. The vulnerable parameter was the database fields containing credentials (private keys, EAP secrets).

Recommendations Upgrade to strongMan version 0.2.0 or later. Run the provided database migrations to re-encrypt all credentials.

Exploit

Fix

Weakness Enumeration

CWE-1204

CWE-323

Related Identifiers

CVE-2026-25998

GHSA-88W4-JV97-C8XR

Affected Products

Strongman

Strongswan

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25998.json · Exploit
• https://github.com/strongswan/strongMan/security/advisories/GHSA-88w4-jv97-c8xr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25998 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25998 · Security Note
• https://twitter.com/trailofbits/status/2024095325581873400 · Twitter Post
• https://t.me/cveNotify/152923 · Telegram Post
• https://twitter.com/CVEnew/status/2025892052249047312 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2024668601710456955 · Twitter Post