Command Injection Vulnerability in NetBird Client by NetBird

CVE-2026-105429

What is CVE-2026-105429?

A command injection vulnerability exists in the NetBird client SSH configuration manager, allowing a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The vulnerability arises from improper handling of peer names during the creation of system-wide OpenSSH configuration files. Specifically, the client incorrectly embeds peer fully qualified domain names (FQDNs) or hostnames within double-quoted context without proper escaping. If a peer name contains a double quote, it can break out of the quoted context and inject malicious SSH directives that may execute commands locally under any user context. All desktop clients on Linux, macOS, Windows, and FreeBSD are susceptible, while mobile applications remain unaffected. The issue has been addressed in version 0.74.7, which enforces validation of peer names as proper DNS names.

References