CVE-2026-19685: Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)
CVE-2025-9615 hardened private-connection FILE certificate and key paths in NetworkManager, but the directory-valued properties 802-1x.ca-path and phase2-ca-path were not included in that guard. An unprivileged user can set these properties on a private connection profile, and NetworkManager (running as root) passes capath/capath2 to wpasupplicant (also running as root) without the privateuser ownership check applied to the FILE-typed CA cert/key properties.
By pointing ca-path/phase2-ca-path at an attacker-controlled CA directory, an unprivileged local user can subvert WPA-Enterprise (802.1X) server certificate validation. On an existing corporate/eduroam profile, this lets an evil-twin AP pass certificate validation, allowing capture of the user's EAP credentials (e.g. MSCHAPv2 hash via hostapd-wpe in the reporter's PoC). The control case with /etc/ssl/certs was correctly rejected.
Scope: WPA-Enterprise (802.1X) networks only; not applicable to open or PSK networks. Requires an active local seat with the (typically passwordless) settings.modify.own permission; not exploitable via an inactive SSH session alone.
Reported by BreachX Zero Day Labs (BreachPoint Pvt Ltd, India) as part of a CERT-In coordinated disclosure also sent to Ubuntu Security and Debian Security, and copied to CERT-In (vdisclose.in). Internal reporter ID: CERT-IN-06-NM-CA-PATH.
Affected versions per reporter: Ubuntu NM 1.54.3, Kali 1.54.0, upstream tip 1.59.2-dev (commit 1947869) at time of report.
Reference: PSIRTSUPT-20440.
Other sources
NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/network-managerto a version that resolves this vulnerability.Fixed in 1.42.4-1+deb12u1Fixed in 1.52.1-1Fixed in 1.58.1-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that use NetworkManager to connect to WPA-Enterprise (802.1X) networks, such as corporate or eduroam profiles, are in scope. Open and PSK networks are not affected.
What access does an attacker need?
The attacker needs an active local seat with the settings.modify.own permission, which is typically passwordless. An inactive SSH session alone is not sufficient.
What can an attacker achieve?
An unprivileged local user can configure an attacker-controlled CA directory on a private connection profile, causing an evil-twin access point to pass server certificate validation. This can enable capture of the user's EAP credentials, including an MSCHAPv2 hash in the reported proof of concept.
Does using the system CA certificate directory trigger the issue?
The reported control case using /etc/ssl/certs was correctly rejected. The bypass relies on pointing the directory-valued CA path properties at an attacker-controlled CA directory.