CVE-2026-105429

Deferred Deferred - Pending Action

SSH Command Injection in NetBird Client

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: securin

Description

Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide OpenSSH drop-in file (/etc/ssh/ssh_config.d/99-netbird.conf, or the equivalent under %PROGRAMDATA%\ssh\ssh_config.d on Windows) that embeds each peer FQDN or hostname inside a double-quoted Match host directive without escaping. A peer name containing a double quote breaks out of the quoted context and injects arbitrary SSH configuration directives, including exec commands, which run locally as any user on the host the next time that user runs ssh. Desktop clients on Linux, macOS, Windows and FreeBSD are affected; the Android and iOS apps are not. The issue is fixed in version 0.74.7, which accepts a peer FQDN or hostname only if it is a valid DNS name.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105429

EUVD

EUVD-2026-100813

Affected Vendors & Products

Vendor	Product	Version / Range
NetBird	NetBird	0.60.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper handling of peer FQDN or hostname values in NetBird's SSH configuration generation. The client writes a system-wide OpenSSH config file embedding peer names in Match host directives without escaping. A peer name containing a double quote can break out of the quoted context, injecting arbitrary SSH configuration directives, including exec commands that run locally when a user executes ssh.

Detection Guidance

Check for the presence of the vulnerable SSH config file at /etc/ssh/ssh_config.d/99-netbird.conf (Linux/macOS) or %PROGRAMDATA%\ssh\ssh_config.d\99-netbird.conf (Windows). Inspect the file for unescaped double quotes or malicious directives in Match host entries.

Impact Analysis

An attacker could exploit this to execute arbitrary commands on your system as any user when you run ssh. This requires a malicious or compromised peer in your NetBird network. The attack affects desktop clients on Linux, macOS, Windows, and FreeBSD running versions 0.60.0 through 0.74.6.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized command execution on systems handling sensitive data. The flaw allows attackers to inject arbitrary SSH commands via manipulated peer hostnames, which may lead to unauthorized access to protected health information (PHI) or personal data, breaching confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade NetBird to version 0.74.7 or later. Remove the vulnerable config file if present and restart the SSH service. Ensure peer FQDNs/hostnames are validated as proper DNS names to prevent injection.

Hi! I’m here to help you understand CVE-2026-105429. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70