CVE-2026-105429: NetBird client SSH config Match line injection via peer FQDN or hostname allows local command execution
Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide OpenSSH drop-in file (/etc/ssh/sshconfig.d/99-netbird.conf, or the equivalent under %PROGRAMDATA%\ssh\sshconfig.d on Windows) that embeds each peer FQDN or hostname inside a double-quoted Match host directive without escaping. A peer name containing a double quote breaks out of the quoted context and injects arbitrary SSH configuration directives, including exec commands, which run locally as any user on the host the next time that user runs ssh. Desktop clients on Linux, macOS, Windows and FreeBSD are affected; the Android and iOS apps are not. The issue is fixed in version 0.74.7, which accepts a peer FQDN or hostname only if it is a valid DNS name.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NetBird clientto a version that resolves this vulnerability.Fixed in 0.74.7
Event History
Frequently Asked Questions
Which systems and clients are affected?
NetBird desktop clients on Linux, macOS, Windows, and FreeBSD are affected in versions 0.60.0 through 0.74.6. Android and iOS apps are not affected.
What must an attacker control to exploit this issue?
The attacker must be able to introduce or control a NetBird peer with a malicious FQDN or hostname, such as through a malicious or compromised peer. The crafted name must contain a double quote to escape the quoted SSH Match host value and inject SSH directives.
When does injected code execute, and under which account?
Injected SSH exec directives run the next time a user on the affected host runs ssh. They execute locally as that user, so impact depends on which users invoke SSH on the machine.
What should be done if an immediate upgrade is not possible?
Review the NetBird-managed system-wide SSH drop-in file for unexpected content: /etc/ssh/ssh_config.d/99-netbird.conf on applicable systems, or the equivalent under %PROGRAMDATA%\ssh\ssh_config.d on Windows. Treat peer names containing unexpected characters, particularly double quotes, and unexpected SSH directives such as exec as indicators requiring investigation.
What version fixes the issue?
Upgrade the NetBird client to version 0.74.7. The fix restricts peer FQDNs and hostnames to valid DNS names.