Vulnerability in SSTP VPN Plugin for NetworkManager by Red Hat
CVE-2026-91838

7.8HIGH

Key Information:

Vendor

Gnome
Status
Networkmanager-sstp
Vendor
CVE Published:
25 September 2026

What is CVE-2026-91838?

A security flaw has been identified in the SSTP VPN plugin for NetworkManager, which permits a local unprivileged user to exploit the vulnerability by inserting special shell metacharacters in VPN connection profile fields, such as CA certificates or proxy settings. When a malicious VPN connection is activated, these unescaped characters are processed by the pppd daemon, which executes with root privileges. This behavior can potentially allow an attacker to run arbitrary commands with elevated permissions, compromising system integrity and security.

Affected Version(s)

NetworkManager-sstp 0

References

https://access.redhat.com/security/cve/CVE-2026-91838
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2533637
issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/network-manager-sstp/-/wor...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Andreas Gabriel Berbescu for reporting this issue.
.