CVE-2026-91837: NetworkManager-iodine Privilege Escalation

CVE-2026-91837 Overview

CVE-2026-91837 is a command injection vulnerability in NetworkManager-iodine, the iodine Virtual Private Network (VPN) plugin for NetworkManager. A local unprivileged user can inject shell metacharacters into the nameserver connection setting. The plugin passes that value to a shell context while still running with elevated permissions. The injected commands execute as root before the plugin drops privileges, resulting in local privilege escalation. The flaw is classified as Improper Neutralization of Special Elements used in an OS Command [CWE-78].

Critical Impact
An unprivileged local account can obtain root-level code execution on any system where NetworkManager-iodine is installed and VPN configuration is permitted.

Affected Products

NetworkManager-iodine (iodine VPN plugin for NetworkManager)
Linux distributions packaging the vulnerable plugin, including Red Hat Enterprise Linux variants
GNOME network-manager-iodine upstream project

Discovery Timeline

2026-09-25 - CVE-2026-91837 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-91837

Vulnerability Analysis

The vulnerability resides in how the NetworkManager-iodine plugin processes the nameserver configuration value when establishing an iodine VPN tunnel. The plugin accepts attacker-controlled input from the connection properties and incorporates it into a command string without neutralizing shell metacharacters such as ;, |, `, or $(). Because the plugin executes this command before dropping its elevated permissions, any injected payload runs with root privileges.

Iodine tunnels Internet Protocol version 4 (IPv4) traffic over Domain Name System (DNS) queries and relies on an operator-supplied nameserver. NetworkManager plugins typically run helper binaries under a privileged service context. The missing input validation on nameserver turns a routine VPN configuration field into a direct path from an unprivileged shell to a root shell.

Root Cause

The root cause is improper neutralization of special elements used in an operating system command [CWE-78]. The plugin treats the nameserver string as trusted and concatenates it into a shell-interpreted command. No allowlist, escaping routine, or execve-style argument array isolates the user-supplied value from the shell parser.

Attack Vector

Exploitation requires local access and the ability to create or modify a NetworkManager VPN connection profile referencing the iodine plugin. The attacker sets the nameserver field to a value containing shell metacharacters followed by an arbitrary command. When the connection is activated, NetworkManager invokes the plugin helper, the shell expands the injected payload, and the command runs as root. No user interaction beyond triggering the connection is required.

See the Red Hat CVE Advisory, the Red Hat Bug Report, and the GNOME Work Item Details for upstream technical context.

Detection Methods for CVE-2026-91837

Indicators of Compromise

NetworkManager connection profiles under /etc/NameworkManager/system-connections/ or user profile stores containing shell metacharacters in the nameserver field.
Unexpected child processes of NetworkManager or the iodine plugin helper spawning shells such as /bin/sh, /bin/bash, or utilities like id, chmod, useradd, or curl.
New SUID binaries, modified /etc/passwd or /etc/shadow, or newly created cron entries created during or immediately after a VPN activation event.

Detection Strategies

Hunt for process lineage where NetworkManager or nm-iodine-service is the parent of a shell interpreter executing non-VPN commands.
Audit NetworkManager connection files for the string iodine combined with suspicious characters (;, |, `, $() in the nameserver key.
Monitor auditd for execve events invoked by the iodine plugin with argv entries that do not match the expected iodine client invocation.

Monitoring Recommendations

Enable Linux audit rules for executions originating from NetworkManager plugin directories and forward events to a centralized log platform.
Alert on privilege transitions where an unprivileged user triggers a root-owned process that executes a shell within one second of a NetworkManager state change.
Track creation and modification events on VPN connection profiles and correlate them with the user that initiated the change.

How to Mitigate CVE-2026-91837

Immediate Actions Required

Apply vendor updates for NetworkManager-iodine as soon as they are published by your Linux distribution.
Remove the NetworkManager-iodine package on systems that do not require iodine VPN connectivity.
Restrict which users can create or modify system-wide NetworkManager connections through PolicyKit (polkit) rules.

Patch Information

At the time of publication, Red Hat tracks remediation progress through the Red Hat CVE Advisory and the Red Hat Bug Report. Upstream fix status is tracked in the GNOME Work Item Details. Install the fixed package provided by your distribution once available and restart NetworkManager to load the updated plugin.

Workarounds

Uninstall NetworkManager-iodine on hosts that do not use iodine tunnels.
Tighten PolicyKit so only administrators can add or modify VPN connections, preventing unprivileged users from supplying a malicious nameserver value.
Review existing NetworkManager connection profiles for untrusted nameserver entries and remove any containing shell metacharacters.

bash

# Remove the vulnerable plugin on Red Hat-based systems
sudo dnf remove NetworkManager-iodine

# Restrict VPN connection management to the wheel group via polkit
sudo tee /etc/polkit-1/rules.d/50-nm-vpn.rules >/dev/null <<'EOF'
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.NetworkManager.settings.modify.system" &&
        !subject.isInGroup("wheel")) {
        return polkit.Result.NO;
    }
});
EOF

sudo systemctl restart NetworkManager