CVE-2026-91837

Summary

A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters (special characters that can execute commands) in the 'nameserver' value, an attacker can inject and execute arbitrary commands. These commands run with root privileges before the application drops its elevated permissions, leading to local privilege escalation.

Affected Software

VendorProductVersion RangeStatus
GNOMENetworkManager-iodine0 < *affected

Weaknesses

  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Workarounds

To mitigate this issue, remove the NetworkManager-iodine and iodine packages if they are not required for system functionality. These packages are not installed by default in minimal Red Hat Enterprise Linux installations.

sudo dnf remove NetworkManager-iodine iodine

If these packages are necessary, ensure that only trusted users have the ability to create and activate VPN connections.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References