CVE-2026-105429 Details
Description
Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide OpenSSH drop-in file (/etc/ssh/ssh_config.d/99-netbird.conf, or the equivalent under %PROGRAMDATA%\ssh\ssh_config.d on Windows) that embeds each peer FQDN or hostname inside a double-quoted Match host directive without escaping. A peer name containing a double quote breaks out of the quoted context and injects arbitrary SSH configuration directives, including exec commands, which run locally as any user on the host the next time that user runs ssh. Desktop clients on Linux, macOS, Windows and FreeBSD are affected; the Android and iOS apps are not. The issue is fixed in version 0.74.7, which accepts a peer FQDN or hostname only if it is a valid DNS name.
A vulnerability in the NetBird client SSH configuration manager has been identified, affecting versions 0.60.0 prior to 0.74.6. This issue allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The vulnerability arises from improper handling of peer fully qualified domain names (FQDNs) or hostnames, which are embedded into a system-wide OpenSSH drop-in file without proper escaping. This injection can be exploited by peers with specially crafted names, leading to unauthorized command execution on the affected host.
Users can update to NetBird version 0.74.7 or later, which addresses this vulnerability by validating peer FQDNs and hostnames before they are written to the SSH configuration. Instructions for downloading the latest version are available on the NetBird GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/netbirdio/netbird/pull/6805 | securin | Source CodeVendor |
| https://github.com/netbirdio/netbird/releases/tag/v0.74.7 | securin | Release NotesVendor |
| https://github.com/netbirdio/netbird/security/advisories/GHSA-xmg2-v32j-x2hf | securin | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | securin |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | securin |
Affected Products
| Product | Versions |
|---|---|
| NetBird | >= 0.60.0, < 0.74.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | securin |