CVE-2026-91839: Networkmanager-fortisslvpn: networkmanager-fortisslvpn: local privilege escalation to root via crlf injection in vpn profile credentials
A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed (CR/LF) characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile to inject additional configuration directives. This can lead to arbitrary code execution with root privileges when the crafted VPN connection is activated.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems with NetworkManager-fortisslvpn installed are exposed if a local unprivileged user can create or modify a FortiSSLVPN connection profile and cause that profile to be activated.
What does an attacker need to exploit it?
The attacker needs local access as an unprivileged user and must craft a malicious VPN profile containing CR/LF characters in its credentials. No user interaction is required according to the supplied vector, but the crafted VPN connection must be activated.
How can I tell whether exploitation may already have occurred?
Review FortiSSLVPN connection profiles for unexpected carriage-return or line-feed characters in credential fields and for injected or unexpected configuration directives. Also investigate unexpected VPN profile activations and root-level code execution associated with the VPN service.