CVE-2026-91838 in NetworkManager
Summary
by MITRE • 09/25/2026
A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped characters are then processed by the `pppd` daemon, which runs with root privileges, allowing the attacker to execute arbitrary commands with elevated permissions when a malicious VPN connection is activated.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in NetworkManager-sstp represents a critical privilege escalation flaw within the SSTP VPN plugin for NetworkManager. This security issue stems from improper input validation and sanitization of user-supplied data before it is passed to underlying system processes. Specifically, when an unprivileged local user creates or modifies a VPN connection profile, they can inject shell metacharacters into fields such as CA certificate paths or proxy settings. These special characters are not properly escaped or filtered by the NetworkManager-sstp component prior to being handed off to the pppd daemon. Because pppd operates with root privileges to manage network interfaces and establish secure tunnels, any command injection executed within its context results in arbitrary code execution at the highest level of system authority. This architectural design flaw allows a low-privilege attacker to bypass standard access controls and gain full control over the host system simply by activating a maliciously crafted VPN profile.
From a technical perspective, this vulnerability is classified under CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The root cause lies in the failure to sanitize input strings that are directly interpolated into shell commands or executed via system calls within the pppd process. When NetworkManager-sstp processes a connection request, it constructs command-line arguments for pppd based on the configuration provided by the user. If these configurations contain characters such as semicolons, ampersands, pipes, or backticks without proper escaping, the shell interprets them as control operators rather than literal data. Consequently, instead of treating the input as a static parameter like a file path, the system executes additional commands embedded within that string. This behavior violates the principle of least privilege and fails to enforce strict separation between configuration data and executable logic.
The operational impact of this vulnerability is severe, enabling complete compromise of the affected machine. An attacker with local access can escalate their privileges from an unprivileged user account to root without requiring any additional exploits or social engineering tactics beyond convincing a victim to activate a specific VPN profile. Once elevated permissions are obtained, the attacker can install persistent backdoors, exfiltrate sensitive data, modify system configurations, and pivot to other systems on the network. This is particularly dangerous in environments where users frequently connect to external networks via SSTP, as it turns routine connectivity actions into vectors for full system takeover. The ease of exploitation means that even non-technical attackers could leverage automated tools or simple scripts to trigger this flaw if they have physical or remote shell access with a standard user account.
In terms of threat modeling and industry frameworks, this vulnerability aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving bash/shell commands. It also relates to privilege escalation paths where local users exploit misconfigured services or applications running with higher privileges. The attack vector is classified as Local (L) in the CVSS context because it requires physical or logical access to the machine prior to exploitation. However, the impact on confidentiality, integrity, and availability is high due to the resulting root-level control. Defense-in-depth strategies must address not only the immediate code flaw but also the broader architectural reliance on unprivileged users triggering privileged processes with unsanitized input.
Mitigation efforts should prioritize updating NetworkManager-sstp to versions that include proper input sanitization and escaping mechanisms for all user-provided fields before they are passed to pppd. Administrators should ensure that their systems are patched according to vendor advisories as soon as updates become available. In the interim, restricting local login capabilities or enforcing strict profile management policies can reduce exposure. Additionally, implementing mandatory access control systems such as SELinux or AppArmor can help contain potential damage by limiting what pppd is permitted to do even if command injection occurs. Regular auditing of VPN configurations and monitoring for unusual process executions originating from network manager services are also recommended defensive measures to detect exploitation attempts early.