CVE-2026-25998

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25998", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-09T17:41:55.859Z", "datePublished": "2026-02-19T15:51:35.349Z", "dateUpdated": "2026-02-20T15:42:52.654Z"}, "containers": {"cna": {"title": "strongMan vulnerable to private credential recovery due to key and counter reuse", "problemTypes": [{"descriptions": [{"cweId": "CWE-323", "lang": "en", "description": "CWE-323: Reusing a Nonce, Key Pair in Encryption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1204", "lang": "en", "description": "CWE-1204: Generation of Weak Initialization Vector (IV)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/strongswan/strongMan/security/advisories/GHSA-88w4-jv97-c8xr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/strongswan/strongMan/security/advisories/GHSA-88w4-jv97-c8xr"}], "affected": [{"vendor": "strongswan", "product": "strongMan", "versions": [{"version": "< 0.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-19T15:53:30.113Z"}, "descriptions": [{"lang": "en", "value": "strongMan is a management interface for strongSwan, an OpenSource IPsec-based VPN. When storing credentials in the database (private keys, EAP secrets), strongMan encrypts the corresponding database fields. So far it used AES in CTR mode with a global database key. Together with an initialization vector (IV), a key stream is generated to encrypt the data in the database fields. But because strongMan did not generate individual IVs, every database field was encrypted using the same key stream. An attacker that has access to the database can use this to recover the encrypted credentials. In particular, because certificates, which have to be considered public information, are also encrypted using the same mechanism, an attacker can directly recover a large chunk of the key stream, which allows them to decrypt basically all other secrets especially ECDSA private keys and EAP secrets, which are usually a lot shorter. Version 0.2.0 fixes the issue by switching to AES-GCM-SIV encryption with a random nonce and an individually derived encryption key, using HKDF, for each encrypted value. Database migrations are provided to automatically re-encrypt all credentials."}], "source": {"advisory": "GHSA-88w4-jv97-c8xr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T15:32:21.931190Z", "id": "CVE-2026-25998", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:42:52.654Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25998", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T15:32:21.931190Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:32:23.720Z"}}], "cna": {"title": "strongMan vulnerable to private credential recovery due to key and counter reuse", "source": {"advisory": "GHSA-88w4-jv97-c8xr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "strongswan", "product": "strongMan", "versions": [{"status": "affected", "version": "< 0.2.0"}]}], "references": [{"url": "https://github.com/strongswan/strongMan/security/advisories/GHSA-88w4-jv97-c8xr", "name": "https://github.com/strongswan/strongMan/security/advisories/GHSA-88w4-jv97-c8xr", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "strongMan is a management interface for strongSwan, an OpenSource IPsec-based VPN. When storing credentials in the database (private keys, EAP secrets), strongMan encrypts the corresponding database fields. So far it used AES in CTR mode with a global database key. Together with an initialization vector (IV), a key stream is generated to encrypt the data in the database fields. But because strongMan did not generate individual IVs, every database field was encrypted using the same key stream. An attacker that has access to the database can use this to recover the encrypted credentials. In particular, because certificates, which have to be considered public information, are also encrypted using the same mechanism, an attacker can directly recover a large chunk of the key stream, which allows them to decrypt basically all other secrets especially ECDSA private keys and EAP secrets, which are usually a lot shorter. Version 0.2.0 fixes the issue by switching to AES-GCM-SIV encryption with a random nonce and an individually derived encryption key, using HKDF, for each encrypted value. Database migrations are provided to automatically re-encrypt all credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-323", "description": "CWE-323: Reusing a Nonce, Key Pair in Encryption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1204", "description": "CWE-1204: Generation of Weak Initialization Vector (IV)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-19T15:53:30.113Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25998", "state": "PUBLISHED", "dateUpdated": "2026-02-20T15:42:52.654Z", "dateReserved": "2026-02-09T17:41:55.859Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-19T15:51:35.349Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "strongMan", "vendor": "strongswan", "versions": [{"status": "affected", "version": "< 0.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:strongswan:strongman:0.1.0:*:*:*:*:python:*:*", "matchCriteriaId": "92188FAE-6D6C-483E-B5BD-4E0EE4743F6F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "strongMan is a management interface for strongSwan, an OpenSource IPsec-based VPN. When storing credentials in the database (private keys, EAP secrets), strongMan encrypts the corresponding database fields. So far it used AES in CTR mode with a global database key. Together with an initialization vector (IV), a key stream is generated to encrypt the data in the database fields. But because strongMan did not generate individual IVs, every database field was encrypted using the same key stream. An attacker that has access to the database can use this to recover the encrypted credentials. In particular, because certificates, which have to be considered public information, are also encrypted using the same mechanism, an attacker can directly recover a large chunk of the key stream, which allows them to decrypt basically all other secrets especially ECDSA private keys and EAP secrets, which are usually a lot shorter. Version 0.2.0 fixes the issue by switching to AES-GCM-SIV encryption with a random nonce and an individually derived encryption key, using HKDF, for each encrypted value. Database migrations are provided to automatically re-encrypt all credentials."}, {"lang": "es", "value": "strongMan es una interfaz de gesti\u00f3n para strongSwan, una VPN de c\u00f3digo abierto basada en IPsec. Al almacenar credenciales en la base de datos (claves privadas, secretos EAP), strongMan cifra los campos de la base de datos correspondientes. Hasta ahora utilizaba AES en modo CTR con una clave de base de datos global. Junto con un vector de inicializaci\u00f3n (IV), se genera un flujo de claves para cifrar los datos en los campos de la base de datos. Pero debido a que strongMan no generaba IVs individuales, cada campo de la base de datos fue cifrado utilizando el mismo flujo de claves. Un atacante que tiene acceso a la base de datos puede usar esto para recuperar las credenciales cifradas. En particular, debido a que los certificados, que deben considerarse informaci\u00f3n p\u00fablica, tambi\u00e9n son cifrados utilizando el mismo mecanismo, un atacante puede recuperar directamente una gran parte del flujo de claves, lo que les permite descifrar b\u00e1sicamente todos los dem\u00e1s secretos, especialmente las claves privadas ECDSA y los secretos EAP, que suelen ser mucho m\u00e1s cortos. La versi\u00f3n 0.2.0 soluciona el problema al cambiar al cifrado AES-GCM-SIV con un nonce aleatorio y una clave de cifrado derivada individualmente, utilizando HKDF, para cada valor cifrado. Se proporcionan migraciones de base de datos para volver a cifrar autom\u00e1ticamente todas las credenciales."}], "id": "CVE-2026-25998", "lastModified": "2026-06-17T10:25:34.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25998", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T15:32:21.931190Z", "version": "2.0.3"}}]}, "published": "2026-02-19T17:24:50.127", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/strongswan/strongMan/security/advisories/GHSA-88w4-jv97-c8xr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-323"}, {"lang": "en", "value": "CWE-1204"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "strongMan", "source": "cna", "vendor": "strongswan"}, "product": "strongman", "vendor": "strongswan"}], "analysis": {"en": {"generated_at": "2026-04-17T18:04:11.495465+00:00", "value": {"mitigation_remediation": ["Upgrade strongMan to version 0.2.0 or later and run the provided migration scripts to re\u2011encrypt all credentials.", "Limit access to the database to only necessary trusted services and users; monitor for anomalous read activity.", "Create a secure backup of the current database before performing the migration to ensure recovery if anything goes wrong."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized access to private credentials"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the strongswan:strongMan 0.1.0 release and earlier. The affected product is the management interface for strongSwan; all database fields are encrypted using the flawed scheme. The 0.2.0 version resolves the issue by switching to AES\u2011GCM\u2011SIV with per\u2011record random nonces and unique keys derived by HKDF.", "description_and_impact": "strongMan encrypts sensitive database fields using AES\u2011CTR with a single global key and no per\u2011record IV, causing the same keystream to be reused across all entries. Because the certificates, which are public, are also encrypted in this manner, a database reader can recover a large portion of the keystream and decrypt any other credential stored in the database, including ECDSA private keys and EAP secrets. The result is that an attacker who can read the database can obtain all private keys used by the VPN.", "risk_and_exploitability": "The CVSS base score of 8.7 indicates a high severity risk. The EPSS score is below 1\u202f%, so the likelihood of widespread exploitation remains low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, if an attacker can read the database, credential compromise is almost guaranteed, making this flaw a high\u2011priority security problem. The primary attack vector is local or remote access to the database; no network exposure is required beyond database egress."}}}}, "created": "2026-02-20T10:06:25.687763+00:00", "updated": "2026-04-17T18:15:26.770048+00:00", "vendors": ["strongswan", "strongswan$PRODUCT$strongman"]}