CVE-2026-91840: Networkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn username
A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary program with root privileges when the malicious VPN connection is activated.
Other sources
A privilege escalation flaw was found in NetworkManager-vpnc, the vpnc VPN plugin for NetworkManager. nm-vpnc-service validates plugin-specific VPN configuration items for embedded newline characters, but omits the top-level NMSettingVpn user-name property from this check. This unvalidated username is later serialized verbatim into vpnc's configuration as an "Xauth username" directive. A local unprivileged user can create a VPN profile whose username contains a newline character followed by a "Password helper" directive, causing the root-privileged vpnc process to parse the injected directive and execute an attacker-chosen helper program with UID/EUID 0 when the malicious VPN connection is activated.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using NetworkManager-vpnc are exposed if a local unprivileged user can create or modify a VPN connection profile and cause that connection to be activated. The described impact is local privilege escalation to root.
What does an attacker need to exploit it?
The attacker needs local unprivileged access and the ability to place a newline character in the VPN username field of a VPN connection. Exploitation occurs when the malicious VPN connection is activated.
How does successful exploitation affect the system?
A crafted VPN username can alter the generated vpnc configuration so that an arbitrary program is executed with root privileges. This can compromise confidentiality, integrity, and availability of the affected system.