CVE-2026-10805: Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend
A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10805?
CVE-2026-10805 has a medium severity score of 6.7.
How can I fix CVE-2026-10805?
To fix CVE-2026-10805, update NetworkManager to the latest version that addresses this local privilege escalation vulnerability.
What type of vulnerability is CVE-2026-10805?
CVE-2026-10805 is a local privilege escalation vulnerability resulting from malformed Manufacturer Usage Description (MUD) URLs.
Who can exploit CVE-2026-10805?
A local user can exploit CVE-2026-10805 to escalate their privileges by triggering a script through a crafted MUD URL.
What software is affected by CVE-2026-10805?
CVE-2026-10805 affects NetworkManager, specifically its dhclient backend.