CVE-2026-19685: NetworkManager Auth Bypass Vulnerability

CVE-2026-19685 Overview

CVE-2026-19685 is an authorization flaw in NetworkManager where the private_user restriction is not applied to the 802-1x.ca-path and 802-1x.phase2-ca-path directory-valued connection properties. The issue is an incomplete fix for CVE-2025-9615. An unprivileged local user can point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation. This enables credential theft against a rogue access point impersonating the enterprise network. The weakness is categorized under CWE-863: Incorrect Authorization.

Critical Impact
Local attackers can bypass 802.1X server certificate validation on private connection profiles, exposing EAP credentials to rogue access points.

Affected Products

NetworkManager (upstream, freedesktop.org) — versions containing the incomplete CVE-2025-9615 fix
Red Hat Enterprise Linux distributions shipping the affected NetworkManager package
Downstream Linux distributions consuming the vulnerable NetworkManager sources

Discovery Timeline

2026-08-24 - CVE-2026-19685 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-19685

Vulnerability Analysis

NetworkManager enforces a private_user restriction on user-owned connection profiles to prevent unprivileged users from referencing privileged filesystem paths. The prior fix for CVE-2025-9615 applied this restriction to file-valued 802.1X properties. However, the fix did not cover the directory-valued 802-1x.ca-path and 802-1x.phase2-ca-path properties. These properties tell wpa_supplicant which directory to load trusted CA certificates from during EAP authentication.

Because the restriction is missing, a local user can create a private profile whose CA path points to a directory they control. When the profile activates, the supplicant loads attacker-supplied CA material and accepts a rogue RADIUS server presenting a certificate signed by that CA. The client then completes EAP inner-method exchanges against the rogue server, disclosing MSCHAPv2 hashes, GTC tokens, or other EAP credentials.

Root Cause

The root cause is an incomplete authorization check. The private_user validation logic covers ca-cert and phase2-ca-cert file properties but omits their directory counterparts. See the upstream fixes in NetworkManager commit a8e87381, commit e85cc46d, and Merge Request #2513.

Attack Vector

Exploitation requires local, authenticated access with permission to define a private NetworkManager connection profile. The attacker sets 802-1x.ca-path to a directory populated with a rogue CA. The attacker then stands up a rogue access point advertising the same SSID and a RADIUS server chained to that CA. When the profile connects, server validation succeeds against the attacker's CA and EAP credentials flow to the rogue server. No user interaction beyond profile activation is required.

No verified public exploit code is available. Refer to the Red Hat CVE-2026-19685 Advisory and Red Hat Bugzilla 2515042 for the vendor technical description.

Detection Methods for CVE-2026-19685

Indicators of Compromise

User-owned NetworkManager keyfiles under /etc/NetworkManager/system-connections/ or per-user profile storage that specify ca-path= or phase2-ca-path= referencing directories outside /etc/pki/, /etc/ssl/, or other trusted CA stores.
Presence of unexpected CA certificate files in user-writable directories referenced by 802.1X profiles.
wpa_supplicant logs showing successful EAP handshakes against unfamiliar RADIUS server certificates or issuer DNs.

Detection Strategies

Audit all NetworkManager 802.1X profiles for ca-path and phase2-ca-path values pointing to paths writable by non-root users.
Correlate NetworkManager profile creation events with subsequent EAP authentication attempts to detect profile tampering followed by rogue-AP association.
Monitor nmcli connection and D-Bus AddConnection calls from unprivileged UIDs for changes to 802-1x directory properties.

Monitoring Recommendations

Enable NetworkManager audit logging and forward journald entries for the NetworkManager unit to a centralized log platform.
Track wpa_supplicant events for EAP server certificate subject changes across trusted enterprise SSIDs.
Alert on filesystem writes to any directory referenced by an active 802.1X ca-path value.

How to Mitigate CVE-2026-19685

Immediate Actions Required

Apply the vendor-supplied NetworkManager update that includes commits a8e87381 and e85cc46d as soon as it is available for your distribution.
Inventory existing 802.1X profiles and remove or reset any ca-path or phase2-ca-path values that reference user-writable directories.
Restrict which local users may create or modify NetworkManager connections via polkit rules on org.freedesktop.NetworkManager.settings.modify.own.

Patch Information

The upstream fix extends the private_user restriction to directory-valued 802.1X properties. Track the Red Hat CVE-2026-19685 Advisory for RHEL package versions and consume the corresponding backports from Debian, Ubuntu, Fedora, and SUSE once released. Verify installed NetworkManager builds include both referenced upstream commits.

Workarounds

Enforce a system-wide 802.1X profile provisioned by administrators that pins ca-cert to a specific file path under /etc/pki/ and disallow user overrides.
Use polkit to deny the settings.modify.own action for untrusted local users until patched packages are deployed.
Where feasible, disable per-user connection profile creation and require NetworkManager profiles to be managed centrally by configuration management.

bash

# Example polkit rule restricting private NetworkManager connection modifications
# /etc/polkit-1/rules.d/50-nm-restrict.rules
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.NetworkManager.settings.modify.own" &&
        !subject.isInGroup("netadmin")) {
        return polkit.Result.NO;
    }
});