Privilege Escalation Vulnerability in NetworkManager-vpnc by Red Hat
CVE-2026-91840
7.8HIGH
What is CVE-2026-91840?
A vulnerability has been identified in NetworkManager-vpnc that allows a local unprivileged user to escalate their privileges to root level. This can be executed by injecting a newline character into the VPN username field, which manipulates the vpnc configuration. Once the malicious VPN connection is activated, this exploit can execute arbitrary programs with root privileges, posing a significant security risk to the affected system.
Affected Version(s)
NetworkManager-vpnc 0
References
CVSS V3.1
Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Andreas Gabriel Berbescu for reporting this issue.