Bug 2533651 (CVE-2026-91841)

Summary: CVE-2026-91841 NetworkManager-vpnc: NetworkManager-vpnc: incomplete fix for CVE-2018-10900 allows root privilege escalation via CA-File path newline injection
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege escalation.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2533693    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-15 09:56:30 UTC 
A privilege escalation flaw was found in NetworkManager-vpnc, the vpnc VPN plugin for NetworkManager. This is an incomplete fix for CVE-2018-10900: the original patch rejected embedded newline and carriage-return characters in connection profile properties, but only for ITEM_TYPE_STRING and ITEM_TYPE_SECRET types, leaving ITEM_TYPE_PATH properties such as the CA-File path unprotected. A local unprivileged user can set a CA-File path containing an embedded newline character, which is legal in Unix filenames. nm-vpnc-service writes this value unfiltered into vpnc's configuration, allowing the newline to split it into additional directives, including a "Password helper" directive. When the malicious VPN connection is activated and vpnc processes Xauth authentication, it executes the injected helper via execl() as root, resulting in local privilege escalation to root.