CVE-2026-91838: Networkmanager-sstp: networkmanager-sstp: local privilege escalation to root via shell injection in vpn profile fields
A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped characters are then processed by the pppd daemon, which runs with root privileges, allowing the attacker to execute arbitrary commands with elevated permissions when a malicious VPN connection is activated.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A local unprivileged user who can create or modify an SSTP VPN connection profile with attacker-controlled fields is exposed. The issue is triggered when the malicious VPN connection is activated.
What profile settings are relevant to exploitation?
The affected input includes VPN profile fields such as the CA certificate or proxy settings. Shell metacharacters placed in these fields can be processed by pppd.
Why does successful exploitation result in root access?
pppd processes the unescaped profile values while running with root privileges. This allows commands injected through the malicious profile to execute with elevated permissions.