IPsec/Strongswan CVE-2026-47895

[Gauss23]

Hi,

is OPNsense affected by https://www.strongswan.org/blog/2026/06/08/strongswan-vulnerability-(cve-2026-47895).html ?

Looks like 6.0.6 is the version currently installed with 26.1.9.

As this might be used for RCE without any authentication, it should be addressed, if affected.

Thank you.

[Monviech (Cedrik)]

Scope of this seems to be pretty contained:

Servers that don't use EAP or XAuth authentication are not vulnerable to remote attacks.

[franco]

Yep fixed in 6.0.7 so we're looking at that for 26.1.10

https://github.com/strongswan/strongswan/releases/tag/6.0.7