Bug 2515042 (CVE-2026-19685)

Summary:	CVE-2026-19685 NetworkManager: NetworkManager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing WPA-Enterprise server validation bypass (incomplete fix for CVE-2025-9615)
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	meing, rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-13 03:07:25 UTC

CVE-2025-9615 hardened private-connection FILE certificate and key paths in NetworkManager, but the directory-valued properties 802-1x.ca-path and phase2-ca-path were not included in that guard. An unprivileged user can set these properties on a private connection profile, and NetworkManager (running as root) passes ca_path/ca_path2 to wpa_supplicant (also running as root) without the private_user ownership check applied to the FILE-typed CA cert/key properties.

By pointing ca-path/phase2-ca-path at an attacker-controlled CA directory, an unprivileged local user can subvert WPA-Enterprise (802.1X) server certificate validation. On an existing corporate/eduroam profile, this lets an evil-twin AP pass certificate validation, allowing capture of the user's EAP credentials (e.g. MSCHAPv2 hash via hostapd-wpe in the reporter's PoC). The control case with /etc/ssl/certs was correctly rejected.

Scope: WPA-Enterprise (802.1X) networks only; not applicable to open or PSK networks. Requires an active local seat with the (typically passwordless) settings.modify.own permission; not exploitable via an inactive SSH session alone.

Reported by BreachX Zero Day Labs (BreachPoint Pvt Ltd, India) as part of a CERT-In coordinated disclosure also sent to Ubuntu Security and Debian Security, and copied to CERT-In (vdisclose.in). Internal reporter ID: CERT-IN-06-NM-CA-PATH.

Affected versions per reporter: Ubuntu NM 1.54.3, Kali 1.54.0, upstream tip 1.59.2-dev (commit 1947869) at time of report.

Reference: PSIRTSUPT-20440.

Comment 1 Melissa Ing 2026-08-24 19:56:00 UTC

Public upstream fix confirmed.
- MR: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2513
- Fix commit a8e87381 (Josephine Pfeiffer, 2026-08-20): rejects 802.1x ca-path/phase2-ca-path on private connections. Message explicitly says "Fixes CVE-2026-19685".
- Introducing commit e85cc46 (CVE-2025-9615 blob pass) was previously mislabeled as the fix; it is the incomplete change this CVE tracks.
- First fixed release: NetworkManager 1.58.1 (also in 1.60 development NEWS). Affected upstream window: 1.57.1-dev through 1.58.0.
- CISA CVSS 9.8 AV:N is incorrect for this local settings.modify.own issue; nist_cvss_validation set to REJECTED. RH CVSS still needed if the add below did not land.

Comment 2 Melissa Ing 2026-08-24 21:01:42 UTC

Thank you to Vivek Parikh from BreachX Zero Day Labs, who reported this vulnerability.