CVE-2026-91838 Details
Description
A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped characters are then processed by the `pppd` daemon, which runs with root privileges, allowing the attacker to execute arbitrary commands with elevated permissions when a malicious VPN connection is activated.
A local privilege escalation vulnerability has been identified in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. This flaw allows an unprivileged user to inject shell metacharacters into VPN connection profile fields, such as the CA certificate or proxy settings. The unescaped characters are processed by the pppd daemon, which operates with root privileges. As a result, an attacker can execute arbitrary commands with elevated rights when the malicious VPN connection is activated.
Users can remove the NetworkManager-sstp package to eliminate the vulnerability, although this may impact functionality that relies on SSTP VPN connections.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.gnome.org/GNOME/network-manager-sstp/-/work_items/67 | CISA-ADP | ExploitTechnical AnalysisVendor |
| https://access.redhat.com/security/cve/CVE-2026-91838 | [email protected] | AdvisoryNot ApplicableVendor |
| https://bugzilla.redhat.com/show_bug.cgi?id=2533637 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://gitlab.gnome.org/GNOME/network-manager-sstp/-/work_items/67 | [email protected] | ExploitTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NetworkManager-sstp | 1.3.2-1+b5 (semver) release-1.3.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | [email protected] |