CVE-2026-91841
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege escalation.
Risk Assessment
A local unprivileged user can gain full root privileges, leading to complete system compromise. This poses a serious threat to workstations and servers with the plugin installed.
Recommendation
Update NetworkManager-vpnc to a version containing the fix. Until patched, restrict local access to trusted users and monitor for unusual VPN connection activations.
Other vulnerabilities in NetworkManager-vpnc
Original NVD description (English source)
A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege escalation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS