CVE-2026-91838
Received Received - Intake

NetworkManager-sstp Privilege Escalation via Shell Metacharacters

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: Fedora Project

Description
A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped characters are then processed by the `pppd` daemon, which runs with root privileges, allowing the attacker to execute arbitrary commands with elevated permissions when a malicious VPN connection is activated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-26
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-91838
EUVD
EUVD-2026-87248

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
networkmanager networkmanager-sstp *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in NetworkManager-sstp, a plugin for managing SSTP VPN connections. A local unprivileged user can inject shell metacharacters into VPN profile fields like CA certificate or proxy settings. When the VPN connection is activated, these unescaped characters are processed by the root-privileged pppd daemon, enabling arbitrary command execution with elevated permissions.

Detection Guidance

Check NetworkManager-sstp configuration files for special characters in VPN profile fields like CA certificate or proxy settings. Review logs for pppd daemon execution with unexpected arguments or commands.

Impact Analysis

If exploited, this flaw allows an attacker with local access to run arbitrary commands as root. This could lead to full system compromise, unauthorized data access, installation of malware, or disruption of services. Users relying on SSTP VPNs via NetworkManager-sstp are particularly at risk.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, undermining confidentiality and integrity controls. Organizations using affected systems may face regulatory penalties, data breach notifications, and reputational damage under standards like GDPR or HIPAA.

Mitigation Strategies

Update NetworkManager-sstp to the latest patched version. Restrict write access to VPN profile files to prevent unauthorized modifications. Monitor pppd daemon execution for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91838. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart