CVE-2026-91841 Details
Description
A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege escalation.
A local privilege escalation vulnerability has been identified in NetworkManager-vpnc, a VPN plugin for NetworkManager. The issue arises from the plugin's failure to properly validate newline characters in the CA-File path. A local unprivileged user can exploit this flaw by injecting a newline, which is then interpreted as a command directive. This manipulation allows the execution of arbitrary commands with root privileges.
If the vpnc VPN plugin functionality is not needed, the NetworkManager-vpnc package can be removed using the 'sudo dnf remove NetworkManager-vpnc' command. However, this will disable vpnc-based VPN connections.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.gnome.org/Archive/NetworkManager-vpnc/-/work_items/20 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://access.redhat.com/security/cve/CVE-2026-91841 | [email protected] | AdvisoryRemedyVendor |
| https://bugzilla.redhat.com/show_bug.cgi?id=2533651 | [email protected] | Issue TrackingPermission RequiredVendor |
| https://gitlab.gnome.org/Archive/NetworkManager-vpnc/-/work_items/20 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NetworkManager-vpnc | >= 1.2.6, <= 1.2.6 (semver) >= 1.4.0-2, <= 1.4.0-2 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 28, 2026 | CVE Modified | CISA-ADP |
| Sep 26, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | [email protected] |