CVE-2026-91840
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary program with root privileges when the malicious VPN connection is activated.
Risk Assessment
A local unprivileged user can gain full root privileges, leading to complete system compromise. This poses a serious threat to workstations and servers with the plugin installed.
Recommendation
Update NetworkManager-vpnc to a version containing the fix. Until patched, restrict local access to trusted users and monitor for unusual VPN connection activations.
Other vulnerabilities in NetworkManager-vpnc
Original NVD description (English source)
A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary program with root privileges when the malicious VPN connection is activated.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS