CVE-2026-105429 Overview
CVE-2026-105429 is a command injection vulnerability in the NetBird client SSH configuration manager (client/ssh/config/manager.go). NetBird versions 0.60.0 through 0.74.6 write a system-wide OpenSSH drop-in file that embeds peer FQDNs or hostnames inside a double-quoted Match host directive without escaping special characters. A malicious or compromised peer can supply a name containing a double quote to break out of the quoted context and inject arbitrary SSH configuration directives, including exec commands. These directives execute locally the next time any user on the host runs ssh. Desktop clients on Linux, macOS, Windows, and FreeBSD are affected; Android and iOS apps are not.
Critical Impact
A compromised peer in a NetBird network can achieve arbitrary command execution on other peers' hosts by injecting OpenSSH exec directives into the system-wide SSH client configuration.
Affected Products
- NetBird desktop client for Linux (versions 0.60.0 through 0.74.6)
- NetBird desktop client for macOS, Windows, and FreeBSD (versions 0.60.0 through 0.74.6)
- NetBird SSH configuration manager component (client/ssh/config/manager.go)
Discovery Timeline
- 2026-10-14 - CVE-2026-105429 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-105429
Vulnerability Analysis
The NetBird client maintains SSH client configuration by writing a drop-in file at /etc/ssh/ssh_config.d/99-netbird.conf on Unix-like systems, or the equivalent path under %PROGRAMDATA%\ssh\ssh_config.d on Windows. The configuration manager generates Match host blocks for each known peer and embeds the peer's FQDN or hostname inside double quotes.
The manager does not neutralize special characters in those names before writing them into the file. This classifies as OS Command Injection via improper input neutralization [CWE-78]. OpenSSH parses the resulting configuration during every client invocation, so injected directives run with the privileges of the invoking user.
Root Cause
The root cause is missing validation and escaping of peer hostnames in client/ssh/config/manager.go. The code trusts peer-supplied names and places them verbatim inside a double-quoted directive. A hostname containing a double quote terminates the quoted token early, allowing the remainder of the string to be interpreted as additional SSH configuration options. Version 0.74.7 fixes the issue by rejecting any peer FQDN or hostname that is not a valid DNS name.
Attack Vector
An attacker must control or compromise a peer in the target NetBird network and set a crafted hostname containing a double quote followed by SSH directives such as Match exec, ProxyCommand, or LocalCommand. When the victim's NetBird client synchronizes peer metadata, it rewrites 99-netbird.conf and injects the malicious directives into the system-wide SSH configuration. The payload executes under the victim user's identity the next time that user runs ssh on the host.
No verified proof-of-concept code has been published. See the GitHub Security Advisory GHSA-xmg2-v32j-x2hf for the maintainer's technical description.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-105429
Indicators of Compromise
- Unexpected directives such as Match exec, LocalCommand, ProxyCommand, or PermitLocalCommand yes present in /etc/ssh/ssh_config.d/99-netbird.conf or %PROGRAMDATA%\ssh\ssh_config.d\99-netbird.conf.
- Lines in the drop-in file where a Match host directive contains an embedded double-quote character or newline inside the quoted hostname.
- Child processes spawned by ssh, sshd-session, or the local SSH client that do not match normal SSH connection activity.
Detection Strategies
- Hash and track 99-netbird.conf across managed hosts. Flag changes that introduce exec-related directives or multi-line hostnames.
- Alert on NetBird client versions between 0.60.0 and 0.74.6 reported by endpoint inventory.
- Review peer registration events in the NetBird management plane for hostnames containing quotes, backticks, or shell metacharacters.
Monitoring Recommendations
- Monitor process execution chains where the parent is ssh and the child is a shell, interpreter, or scripting engine.
- Audit modifications to files under /etc/ssh/ssh_config.d/ and %PROGRAMDATA%\ssh\ssh_config.d\ using file integrity monitoring.
- Correlate NetBird peer-sync events with subsequent writes to the SSH drop-in file to identify malicious peer-triggered changes.
How to Mitigate CVE-2026-105429
Immediate Actions Required
- Upgrade all NetBird desktop clients to version 0.74.7 or later on Linux, macOS, Windows, and FreeBSD hosts.
- Inspect /etc/ssh/ssh_config.d/99-netbird.conf and the Windows equivalent for injected directives, and remove any content not generated by a trusted client version.
- Rotate credentials and audit command history on hosts where injected exec, LocalCommand, or ProxyCommand directives were present.
Patch Information
NetBird version 0.74.7 resolves the vulnerability by validating that each peer FQDN or hostname is a valid DNS name before writing it into the SSH configuration. Patch details are available in GitHub Pull Request #6805 and GitHub Release v0.74.7.
Workarounds
- Remove or empty the 99-netbird.conf drop-in file and restrict write permissions until the client is upgraded, accepting the loss of NetBird-managed SSH convenience features.
- Enforce strict peer naming policy at the NetBird management plane and reject any hostname that is not a valid DNS label.
- Restrict which users can initiate ssh on multi-user hosts to limit the blast radius of a successful injection.
# Configuration example: verify client version and inspect the drop-in file
netbird version
sudo grep -E 'Match exec|LocalCommand|ProxyCommand' /etc/ssh/ssh_config.d/99-netbird.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
