CVE-2026-91840

Summary

A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary program with root privileges when the malicious VPN connection is activated.

Affected Software

VendorProductVersion RangeStatus
GNOMENetworkManager-vpnc0 < *affected

Weaknesses

  • CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

Workarounds

If vpnc VPN connections are not required, the NetworkManager-vpnc package can be removed to eliminate the vulnerability. This action will prevent the system from establishing vpnc-based VPN connections.

To remove the package, execute the following command as root: # dnf remove NetworkManager-vpnc

Note that removing this package may impact functionality if vpnc VPNs are actively used.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: total

Additional References

References