CVE-2026-91837: Networkmanager-iodine: networkmanager-iodine: local privilege escalation to root via nameserver option injection
A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters (special characters that can execute commands) in the 'nameserver' value, an attacker can inject and execute arbitrary commands. These commands run with root privileges before the application drops its elevated permissions, leading to local privilege escalation.
Other sources
A privilege escalation flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. When establishing an iodine VPN connection, nm-iodine-service passes the user-controlled "nameserver" setting from the connection profile to the iodine client binary on the command line without an option terminator. A nameserver value prefixed with "-d" can be reinterpreted by iodine's argument parser as the TUN device name option. Iodine truncates this device name to 15 bytes when calling the kernel's TUNSETIFF ioctl, but keeps the full (up to 250-byte) string in a global buffer that is later interpolated, unsanitized, into an ifconfig command executed via system(). Because this command runs before iodine drops privileges via chroot(), setgid(), and setuid(), a local unprivileged user can embed shell metacharacters in the nameserver value of a VPN connection profile to execute arbitrary commands as root.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A local unprivileged user who can control the nameserver setting in an iodine VPN connection profile can exploit it. Exploitation occurs when an iodine VPN connection is established.
What input is required for exploitation?
The attacker needs to supply a crafted nameserver value. A value beginning with "-d" can be treated as iodine's TUN device-name option, and the later handling of the full value enables unsanitized command injection.
What privileges do injected commands receive?
Injected commands execute with root privileges. They run before the affected service drops its elevated permissions.
How can I determine whether a system may be exposed?
Systems using the NetworkManager-iodine plugin may be exposed if local users can create or modify iodine VPN profiles, particularly the nameserver setting, and can establish those connections.