CVE-2026-61477 in Red Hat
Summary
by MITRE • 08/07/2026
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability resides within libvirt's virtual network driver component where improper input validation creates a critical injection flaw that can be exploited to achieve arbitrary code execution with root privileges. The core issue stems from the network XML parser's failure to sanitize newline characters from DNS TXT record value attributes and SRV record domain/target attributes, allowing maliciously crafted input to bypass normal parsing restrictions. When these unvalidated attributes are written verbatim into the dnsmasq configuration file, they create opportunities for attackers to inject additional configuration directives that would otherwise be prohibited through normal interfaces.
The technical execution path begins with a user possessing permissions to define virtual networks within libvirt's framework, which is typically a restricted role but still represents legitimate administrative access. Once such an attacker crafts malicious DNS records containing newline characters in the affected attributes, these inputs are processed without proper sanitization and subsequently written directly into dnsmasq's configuration file. This configuration file serves as the authoritative source for dnsmasq's operation within the virtualized network environment, making it a prime target for injection attacks.
The operational impact of this vulnerability is severe and potentially catastrophic for virtualized environments that rely on libvirt for network management. Attackers can leverage this flaw to inject arbitrary dnsmasq configuration directives including dhcp-script which executes shell commands when DHCP requests are processed. This creates a direct path to privilege escalation from the attacker's initial access level to root privileges, as dnsmasq typically runs with elevated permissions to manage network services. The vulnerability affects any system where libvirt manages virtual networks and dnsmasq is used for DNS and DHCP services, which represents a significant portion of enterprise virtualization deployments.
This vulnerability aligns with CWE-74 and CWE-94 categories from the Common Weakness Enumeration catalog, specifically addressing improper neutralization of special elements used in data queries and code injection flaws. The attack vector maps directly to ATT&CK technique T1059.001 for command and scripting interpreter execution through shell commands, while also incorporating elements of privilege escalation via service configuration manipulation. The flaw demonstrates a classic case of insufficient input validation combined with dangerous direct data-to-configuration-file writing practices that violate fundamental security principles.
Mitigation strategies should focus on implementing proper input sanitization at the XML parser level to strip or encode newline characters from DNS record attributes before they are processed. Administrators must ensure that only trusted users have permission to define virtual networks and that privilege separation is maintained between network configuration and execution components. Regular updates to libvirt and dnsmasq packages should be prioritized, while monitoring for unusual dnsmasq configuration file modifications can serve as an early detection mechanism. Additionally, implementing principle of least privilege access controls and network segmentation around virtualization hosts can limit the potential impact of successful exploitation attempts.