CVE-2026-19685

Summary

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.

Affected Software

Weaknesses

• CWE-863: Incorrect Authorization

Workarounds

Upstream fix is public: NetworkManager rejects 802-1x.ca-path and 802-1x.phase2-ca-path on private connections (those with connection.permissions) and requires ca-cert or system-ca-certs instead. Fixed upstream in commit a8e87381 (MR 2513), shipped in NetworkManager 1.58.1 and later 1.60 development snapshots. Until the fixed package is installed, use system-wide 802.1X profiles rather than per-user private ones, or set 802-1x.system-ca-certs=yes so the compiled system CA path overrides any user-supplied ca-path.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

References

• https://access.redhat.com/security/cve/CVE-2026-19685
• https://bugzilla.redhat.com/show_bug.cgi?id=2515042
• https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/a8e87381a3e70060abd721d9a347f42b2ba68e6e
• https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/e85cc46d0b36cdba50fe8411cc93d55a49ebfccf
• https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2513

• ←Previous
• Next→