CVE-2026-25998

strongMan vulnerable to private credential recovery due to key and counter reuse

Published Feb 19, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

strongMan is a management interface for strongSwan, an OpenSource IPsec-based VPN. When storing credentials in the database (private keys, EAP secrets), strongMan encrypts the corresponding database fields. So far it used AES in CTR mode with a global database key. Together with an initialization vector (IV), a key stream is generated to encrypt the data in the database fields. But because strongMan did not generate individual IVs, every database field was encrypted using the same key stream. An attacker that has access to the database can use this to recover the encrypted credentials. In particular, because certificates, which have to be considered public information, are also encrypted using the same mechanism, an attacker can directly recover a large chunk of the key stream, which allows them to decrypt basically all other secrets especially ECDSA private keys and EAP secrets, which are usually a lot shorter. Version 0.2.0 fixes the issue by switching to AES-GCM-SIV encryption with a random nonce and an individually derived encryption key, using HKDF, for each encrypted value. Database migrations are provided to automatically re-encrypt all credentials.

Analysis

Technical impact

strongMan encrypts sensitive database fields using AES‑CTR with a single global key and no per‑record IV, causing the same keystream to be reused across all entries. Because the certificates, which are public, are also encrypted in this manner, a database reader can recover a large portion of the keystream and decrypt any other credential stored in the database, including ECDSA private keys and EAP secrets. The result is that an attacker who can read the database can obtain all private keys used by the VPN.

Affected Systems

The vulnerability affects the strongswan:strongMan 0.1.0 release and earlier. The affected product is the management interface for strongSwan; all database fields are encrypted using the flawed scheme. The 0.2.0 version resolves the issue by switching to AES‑GCM‑SIV with per‑record random nonces and unique keys derived by HKDF.

Risk and Exploitability

The CVSS base score of 8.7 indicates a high severity risk. The EPSS score is below 1 %, so the likelihood of widespread exploitation remains low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, if an attacker can read the database, credential compromise is almost guaranteed, making this flaw a high‑priority security problem. The primary attack vector is local or remote access to the database; no network exposure is required beyond database egress.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

strongswan

strongMan

affected

Version	Status	Constraints
`< 0.2.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:strongswan:strongman:0.1.0:*:*:*:*:python:*:*

No data.

Vendor Product Versions

Strongswan

Strongman

Version	Status	Scheme	Platform
`[0,0.2.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade strongMan to version 0.2.0 or later and run the provided migration scripts to re‑encrypt all credentials.
Limit access to the database to only necessary trusted services and users; monitor for anomalous read activity.
Create a secure backup of the current database before performing the migration to ensure recovery if anything goes wrong.

Generated by OpenCVE AI on April 17, 2026 at 18:04 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.345% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/strongswan/strongMan/security/advisories/GHSA-88w4-jv97-c8xr

History

Feb 23, 2026 7:45 PM Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:strongswan:strongman:0.1.0:::::python::
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Feb 20, 2026 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 20, 2026 10:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Strongswan Strongswan strongman
Vendors & Products		Strongswan Strongswan strongman

Feb 19, 2026 4:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		strongMan is a management interface for strongSwan, an OpenSource IPsec-based VPN. When storing credentials in the database (private keys, EAP secrets), strongMan encrypts the corresponding database fields. So far it used AES in CTR mode with a global database key. Together with an initialization vector (IV), a key stream is generated to encrypt the data in the database fields. But because strongMan did not generate individual IVs, every database field was encrypted using the same key stream. An attacker that has access to the database can use this to recover the encrypted credentials. In particular, because certificates, which have to be considered public information, are also encrypted using the same mechanism, an attacker can directly recover a large chunk of the key stream, which allows them to decrypt basically all other secrets especially ECDSA private keys and EAP secrets, which are usually a lot shorter. Version 0.2.0 fixes the issue by switching to AES-GCM-SIV encryption with a random nonce and an individually derived encryption key, using HKDF, for each encrypted value. Database migrations are provided to automatically re-encrypt all credentials.
Title		strongMan vulnerable to private credential recovery due to key and counter reuse
Weaknesses		CWE-1204 CWE-323
References		https://github.com/strongswan/strongMan/security/advisories/GHSA-88w4-jv97-c8xr
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`