CVE-2026-91837

A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters (special characters that can execute commands) in the 'nameserver' value, an attacker can inject and execute arbitrary commands. These commands run with root privileges before the application drops its elevated permissions, leading to local privilege escalation.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-91837
https://bugzilla.redhat.com/show_bug.cgi?id=2533634
https://gitlab.gnome.org/GNOME/network-manager-iodine/-/work_items/4

Configurations

No configuration.

History

25 Sep 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-25 17:17

Updated : 2026-09-30 19:57

NVD link : CVE-2026-91837

Mitre link : CVE-2026-91837

CVE.ORG link : CVE-2026-91837

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-91837", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-91837", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-25T16:39:28.774813Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "patrick@puiterwijk.org", "affectedData": [{"vendor": "GNOME", "product": "NetworkManager-iodine", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "semver"}], "packageName": "network-manager-iodine", "collectionURL": "https://gitlab.gnome.org/GNOME/network-manager-iodine", "defaultStatus": "unaffected"}]}], "published": "2026-09-25T17:17:18.983", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-91837", "source": "patrick@puiterwijk.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533634", "source": "patrick@puiterwijk.org"}, {"url": "https://gitlab.gnome.org/GNOME/network-manager-iodine/-/work_items/4", "source": "patrick@puiterwijk.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters (special characters that can execute commands) in the 'nameserver' value, an attacker can inject and execute arbitrary commands. These commands run with root privileges before the application drops its elevated permissions, leading to local privilege escalation."}], "lastModified": "2026-09-30T19:57:08.043", "sourceIdentifier": "patrick@puiterwijk.org"}