CVE-2026-91838

A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped characters are then processed by the `pppd` daemon, which runs with root privileges, allowing the attacker to execute arbitrary commands with elevated permissions when a malicious VPN connection is activated.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-91838
https://bugzilla.redhat.com/show_bug.cgi?id=2533637
https://gitlab.gnome.org/GNOME/network-manager-sstp/-/work_items/67
https://gitlab.gnome.org/GNOME/network-manager-sstp/-/work_items/67

Configurations

No configuration.

History

25 Sep 2026, 19:17

Type	Values Removed	Values Added
References	~~() https://gitlab.gnome.org/GNOME/network-manager-sstp/-/work_items/67 -~~	() https://gitlab.gnome.org/GNOME/network-manager-sstp/-/work_items/67 -

25 Sep 2026, 18:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-25 18:17

Updated : 2026-09-30 19:57

NVD link : CVE-2026-91838

Mitre link : CVE-2026-91838

CVE.ORG link : CVE-2026-91838

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-91838", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-91838", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-25T18:16:05.405073Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "patrick@puiterwijk.org", "affectedData": [{"vendor": "GNOME", "product": "NetworkManager-sstp", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "semver"}], "packageName": "network-manager-sstp", "collectionURL": "https://gitlab.gnome.org/GNOME/network-manager-sstp", "defaultStatus": "unaffected"}]}], "published": "2026-09-25T18:17:32.530", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-91838", "source": "patrick@puiterwijk.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533637", "source": "patrick@puiterwijk.org"}, {"url": "https://gitlab.gnome.org/GNOME/network-manager-sstp/-/work_items/67", "source": "patrick@puiterwijk.org"}, {"url": "https://gitlab.gnome.org/GNOME/network-manager-sstp/-/work_items/67", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped characters are then processed by the `pppd` daemon, which runs with root privileges, allowing the attacker to execute arbitrary commands with elevated permissions when a malicious VPN connection is activated."}], "lastModified": "2026-09-30T19:57:08.043", "sourceIdentifier": "patrick@puiterwijk.org"}