CVE-2026-91838 Overview
CVE-2026-91838 is a command injection vulnerability in NetworkManager-sstp, the Secure Socket Tunneling Protocol (SSTP) VPN plugin for NetworkManager on Linux. A local unprivileged user can embed shell metacharacters into VPN connection profile fields such as the Certificate Authority (CA) certificate path or proxy settings. The pppd daemon, which runs with root privileges, processes these unescaped values during VPN activation. This allows the attacker to execute arbitrary commands as root. The flaw is tracked under CWE-78: Improper Neutralization of Special Elements used in an OS Command.
Critical Impact
Local unprivileged users can escalate to root by crafting a malicious SSTP VPN profile containing shell metacharacters that pppd evaluates with elevated privileges.
Affected Products
- NetworkManager-sstp (SSTP VPN plugin for NetworkManager)
- Linux distributions shipping the vulnerable plugin, including Red Hat Enterprise Linux
- GNOME NetworkManager ecosystem components depending on network-manager-sstp
Discovery Timeline
- 2026-09-25 - CVE-2026-91838 published to the National Vulnerability Database (NVD)
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-91838
Vulnerability Analysis
The vulnerability is a local privilege escalation enabled by OS command injection [CWE-78]. NetworkManager-sstp passes user-controlled VPN profile fields into shell-interpreted contexts without sanitizing shell metacharacters such as ;, |, `, $(), and &. When a user activates an SSTP VPN connection, NetworkManager invokes pppd with these fields. Because pppd executes as root, injected commands inherit root privileges.
Any user permitted to create or modify VPN connection profiles can supply a payload. On typical desktop Linux systems, interactive users are frequently granted this capability through PolicyKit. The result is a reliable path from unprivileged local access to full root compromise.
Root Cause
The root cause is missing input validation and escaping in the plugin's handling of VPN profile string fields. Values such as the CA certificate path and HTTP proxy configuration are concatenated into command strings handed to a shell-aware execution context. Metacharacters are preserved verbatim rather than being quoted, escaped, or filtered against an allowlist.
Attack Vector
An attacker with local, authenticated access creates a new SSTP VPN profile and injects shell metacharacters into a vulnerable field. For example, a crafted CA certificate value such as /tmp/ca.pem; /tmp/payload.sh or a proxy setting containing backticks causes the shell to execute the attacker-controlled command when the connection is activated. The injected payload runs within the pppd process context as root, enabling arbitrary file writes, user creation, or persistence installation.
For exploitation specifics, refer to the Red Hat CVE-2026-91838 Advisory and the GNOME Work Item #67 Description.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-91838
Indicators of Compromise
- Unexpected child processes of pppd or nm-sstp-service such as sh, bash, python, or curl.
- New or modified SSTP VPN connection profiles in /etc/NetworkManager/system-connections/ containing shell metacharacters in ca, proxy, or related fields.
- Root-owned files, cron entries, or SUID binaries created shortly after an SSTP VPN activation event.
Detection Strategies
- Audit SSTP VPN profile fields for characters outside an expected allowlist (paths, hostnames, port numbers).
- Monitor pppd and NetworkManager plugin processes for shell interpreter children, which are not part of normal VPN establishment.
- Correlate NetworkManager activation events in journald with subsequent privileged process creation to surface injection attempts.
Monitoring Recommendations
- Enable auditd rules for execve events whose parent is pppd or any nm-*-service binary.
- Forward NetworkManager and PolicyKit logs to a centralized SIEM for anomaly analysis.
- Alert on modifications to files under /etc/NetworkManager/system-connections/ by non-administrative users.
How to Mitigate CVE-2026-91838
Immediate Actions Required
- Apply vendor updates for NetworkManager-sstp as soon as patched packages are available from your Linux distribution.
- Remove the network-manager-sstp package on systems that do not require SSTP VPN connectivity.
- Restrict PolicyKit rules so that only administrators can create or modify system VPN connection profiles.
Patch Information
At publication, the authoritative patch tracking source is the Red Hat CVE-2026-91838 Advisory and the upstream GNOME Work Item #67 Description. Red Hat tracks remediation progress in Red Hat Bug Report #2533637. Install updated NetworkManager-sstp packages once your distribution publishes them and restart NetworkManager to load the fixed plugin.
Workarounds
- Uninstall or disable the SSTP VPN plugin until a fixed package is deployed.
- Harden PolicyKit so that only trusted administrator accounts can author SSTP profiles, limiting the attacker population.
- Validate existing SSTP profiles for shell metacharacters in CA path and proxy fields and remove any suspicious entries.
# Configuration example: remove the vulnerable plugin on RHEL-based systems
sudo dnf remove NetworkManager-sstp
sudo systemctl restart NetworkManager
# Audit existing SSTP profiles for suspicious metacharacters
sudo grep -REn '[;`|&$]' /etc/NetworkManager/system-connections/ | grep -i sstp
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
