NIXPKGS-2026-1870

GitHub issue published 6 hours ago

Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend

Permalink CVE-2026-10805

6.7 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 6 hours ago by @LeSuisse Activity log

Created suggestion 11 hours ago
@LeSuisse ignored
20 packages
- networkmanager-ssh
- networkmanager_strongswan
- networkmanager-fortisslvpn
- networkmanager-openconnect
- kdePackages.networkmanager-qt
- mobile-broadband-provider-info
- python313Packages.sdbus-networkmanager
- python314Packages.sdbus-networkmanager
- haskellPackages.amazonka-networkmanager
- python313Packages.mypy-boto3-networkmanager
- python314Packages.mypy-boto3-networkmanager
- python313Packages.types-aiobotocore-networkmanager
- networkmanager-vpnc
- networkmanager_dmenu
- networkmanager-iodine
- networkmanager-openvpn
- networkmanager-strongswan
- networkmanager-sstp
- networkmanagerapplet
- networkmanager-l2tp
6 hours ago
@LeSuisse accepted 6 hours ago
@LeSuisse published on GitHub 6 hours ago

Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend

A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.

References

https://access.redhat.com/security/cve/CVE-2026-10805 vdb-entryx_refsource_REDHAT
RHBZ#2484613 issue-trackingx_refsource_REDHAT

Affected products

NetworkManager

networkmanager

network-manager-applet

NetworkManager-openswan

NetworkManager-libreswan

mobile-broadband-provider-info

redhat-user-workloads/art-images

openshift4/ose-ovn-kubernetes-rhel9

openshift4/kubernetes-nmstate-rhel8-operator

openshift4/kubernetes-nmstate-rhel9-operator

openshift4/ose-ovn-kubernetes-microshift-rhel9

openshift4/ose-kubernetes-nmstate-handler-rhel8

openshift4/ose-kubernetes-nmstate-handler-rhel9

openshift4/ose-aws-cluster-api-controllers-rhel8

openshift4/ose-aws-cluster-api-controllers-rhel9

multicluster-engine/cluster-api-provider-aws-rhel9

Matching in nixpkgs

pkgs.networkmanager

Network configuration and management tool

nixos-unstable 1.56.0
- nixpkgs-unstable 1.56.0
- nixos-unstable-small 1.56.0
nixos-26.05 1.56.0
- nixos-26.05-small 1.56.0
- nixpkgs-26.05-darwin 1.56.0

Ignored packages (20)

pkgs.networkmanager-ssh

SSH VPN integration for NetworkManager

nixos-unstable 1.4.2
- nixpkgs-unstable 1.4.2
- nixos-unstable-small 1.4.2
nixos-26.05 1.4.2
- nixos-26.05-small 1.4.2
- nixpkgs-26.05-darwin 1.4.2

pkgs.networkmanager-l2tp

L2TP plugin for NetworkManager

nixos-unstable l2tp-gnome-1.52.0
- nixpkgs-unstable l2tp-gnome-1.52.0
- nixos-unstable-small l2tp-gnome-1.52.0
nixos-26.05 l2tp-gnome-1.52.0
- nixos-26.05-small l2tp-gnome-1.52.0
- nixpkgs-26.05-darwin l2tp-gnome-1.52.0

pkgs.networkmanager-sstp

NetworkManager's sstp plugin

nixos-unstable 1.3.2
- nixpkgs-unstable 1.3.2
- nixos-unstable-small 1.3.2
nixos-26.05 1.3.2
- nixos-26.05-small 1.3.2
- nixpkgs-26.05-darwin 1.3.2

pkgs.networkmanager-vpnc

NetworkManager's VPNC plugin

nixos-unstable 1.4.0
- nixpkgs-unstable 1.4.0
- nixos-unstable-small 1.4.0
nixos-26.05 1.4.0
- nixos-26.05-small 1.4.0
- nixpkgs-26.05-darwin 1.4.0

pkgs.networkmanager_dmenu

Small script to manage NetworkManager connections with dmenu instead of nm-applet

nixos-unstable 2.6.3
- nixpkgs-unstable 2.6.3
- nixos-unstable-small 2.6.3
nixos-26.05 2.6.3
- nixos-26.05-small 2.6.3
- nixpkgs-26.05-darwin 2.6.3

pkgs.networkmanagerapplet

NetworkManager control applet for GNOME

nixos-unstable 1.36.0
- nixpkgs-unstable 1.36.0
- nixos-unstable-small 1.36.0
nixos-26.05 1.36.0
- nixos-26.05-small 1.36.0
- nixpkgs-26.05-darwin 1.36.0

pkgs.networkmanager-iodine

NetworkManager's iodine plugin

nixos-unstable 1.2.0-unstable-2025-12-22
- nixpkgs-unstable 1.2.0-unstable-2025-12-22
- nixos-unstable-small 1.2.0-unstable-2025-12-22
nixos-26.05 1.2.0-unstable-2025-12-22
- nixos-26.05-small 1.2.0-unstable-2025-12-22
- nixpkgs-26.05-darwin 1.2.0-unstable-2025-12-22

pkgs.networkmanager-openvpn

NetworkManager's OpenVPN plugin

nixos-unstable 1.12.3
- nixpkgs-unstable 1.12.3
- nixos-unstable-small 1.12.3
nixos-26.05 1.12.3
- nixos-26.05-small 1.12.3
- nixpkgs-26.05-darwin 1.12.3

pkgs.networkmanager-strongswan

NetworkManager's strongswan plugin

nixos-unstable 1.6.5
- nixpkgs-unstable 1.6.5
- nixos-unstable-small 1.6.5
nixos-26.05 1.6.5
- nixos-26.05-small 1.6.5
- nixpkgs-26.05-darwin 1.6.5

pkgs.networkmanager_strongswan

NetworkManager's strongswan plugin

nixos-unstable 1.6.5
- nixpkgs-unstable 1.6.5
- nixos-unstable-small 1.6.5
nixos-26.05 1.6.5
- nixos-26.05-small 1.6.5
- nixpkgs-26.05-darwin 1.6.5

pkgs.networkmanager-fortisslvpn

NetworkManager’s FortiSSL plugin

nixos-unstable 1.4.0
- nixpkgs-unstable 1.4.0
- nixos-unstable-small 1.4.0
nixos-26.05 1.4.0
- nixos-26.05-small 1.4.0
- nixpkgs-26.05-darwin 1.4.0

pkgs.networkmanager-openconnect

NetworkManager’s OpenConnect plugin

nixos-unstable 1.2.10
- nixpkgs-unstable 1.2.10
- nixos-unstable-small 1.2.10
nixos-26.05 1.2.10
- nixos-26.05-small 1.2.10
- nixpkgs-26.05-darwin 1.2.10

pkgs.kdePackages.networkmanager-qt

Qt wrapper for NetworkManager API.

nixos-unstable 6.26.0
- nixpkgs-unstable 6.26.0
- nixos-unstable-small 6.26.0
nixos-26.05 6.26.0
- nixos-26.05-small 6.26.0
- nixpkgs-26.05-darwin 6.26.0

pkgs.mobile-broadband-provider-info

Mobile broadband service provider database

nixos-unstable 20240407
- nixpkgs-unstable 20240407
- nixos-unstable-small 20240407
nixos-26.05 20240407
- nixos-26.05-small 20240407
- nixpkgs-26.05-darwin 20240407