CVE-2026-91837

Deferred Deferred - Pending Action

Command Injection in NetworkManager-iodine VPN Plugin

Publication date: 2026-09-25

Last updated on: 2026-09-30

Assigner: Fedora Project

Description

A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters (special characters that can execute commands) in the 'nameserver' value, an attacker can inject and execute arbitrary commands. These commands run with root privileges before the application drops its elevated permissions, leading to local privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-30

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-91837

EUVD

EUVD-2026-87155

Affected Vendors & Products

Vendor	Product	Version / Range
networkmanager	iodine	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is in NetworkManager-iodine, an iodine VPN plugin. A local unprivileged user can exploit it by embedding shell metacharacters in the 'nameserver' setting when establishing an iodine VPN connection. This allows command injection, which executes arbitrary commands with root privileges before permissions are dropped, leading to local privilege escalation.

Detection Guidance

To detect this vulnerability, check if NetworkManager-iodine is installed on your system. Run: rpm -q networkmanager-iodine or dpkg -l networkmanager-iodine. If installed, inspect VPN connection configurations for suspicious 'nameserver' values containing shell metacharacters like semicolons or backticks. Review logs for unexpected command execution during VPN setup.

Impact Analysis

If you use NetworkManager-iodine, an attacker with local access could exploit this to run malicious commands as root on your system. This could allow them to take full control of your machine, install malware, or steal sensitive data.

Compliance Impact

This vulnerability allows local privilege escalation to root via command injection in NetworkManager-iodine. Compliance with GDPR or HIPAA could be affected if unauthorized root access enables data exfiltration, unauthorized modifications, or system compromise, violating confidentiality and integrity requirements.

Mitigation Strategies

Update NetworkManager-iodine to the latest patched version immediately. Disable the iodine VPN plugin if not in use. Monitor system logs for suspicious activity related to command injection attempts.

Hi! I’m here to help you understand CVE-2026-91837. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70