CVE-2026-91839: NetworkManager-fortisslvpn RCE Vulnerability

CVE-2026-91839 Overview

CVE-2026-91839 is a CRLF (carriage-return/line-feed) injection vulnerability in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager on Linux systems. The nm-fortisslvpn-service fails to sanitize CR/LF characters in VPN connection profile credentials. A local unprivileged user can craft a malicious VPN profile to inject additional configuration directives. When the crafted connection is activated, the injected directives execute as root, giving the attacker arbitrary code execution with full privileges.

Critical Impact

A local unprivileged user can escalate to root by injecting configuration directives into a FortiSSLVPN connection profile.

Affected Products

• NetworkManager-fortisslvpn (FortiSSLVPN plugin for NetworkManager)
• Red Hat Enterprise Linux distributions shipping the affected package
• GNOME NetworkManager-fortisslvpn upstream project

Discovery Timeline

• 2026-09-25 - CVE CVE-2026-91839 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-91839

Vulnerability Analysis

The flaw is classified as [CWE-93] Improper Neutralization of CRLF Sequences. The nm-fortisslvpn-service daemon reads credential and configuration values from VPN connection profiles and writes them to a configuration file consumed by the underlying openfortivpn process. The service runs with elevated privileges to establish network interfaces and route changes.

Because CR and LF characters are not stripped or escaped before being written to the configuration, an attacker can embed newline sequences inside a credential field. The injected newlines terminate the current directive and introduce attacker-controlled directives on subsequent lines. Those directives may include options that cause the privileged helper to execute arbitrary commands or load attacker-supplied scripts.

The attack requires only local, low-privileged access. No user interaction is needed beyond the attacker activating their own VPN profile, which any local user is typically permitted to do through NetworkManager's D-Bus interface.

Root Cause

The root cause is missing input validation on string fields pulled from VPN connection settings before they are serialized into a configuration file. The service treats profile credentials as trusted scalar strings rather than as untrusted multi-line input requiring neutralization of CR (\r) and LF (\n) bytes.

Attack Vector

An attacker with a local shell on the target host creates a NetworkManager VPN connection profile for the FortiSSLVPN plugin. The attacker places CR/LF sequences inside a credential field followed by additional openfortivpn configuration directives that reference attacker-controlled binaries or scripts. When the attacker activates the VPN connection, nm-fortisslvpn-service writes the poisoned configuration and invokes the backend as root, executing the injected directives. See the Red Hat CVE-2026-91839 Advisory and GNOME Work Item #80 for upstream technical details.

Detection Methods for CVE-2026-91839

Indicators of Compromise

• Unexpected child processes spawned by nm-fortisslvpn-service or openfortivpn running as root.
• NetworkManager VPN connection profiles containing embedded \r or \n byte sequences in credential or username fields.
• New or modified files under /etc/NetworkManager/system-connections/ with unusual configuration directives.
• Outbound network connections initiated by processes spawned from the FortiSSLVPN service that do not match the expected openfortivpn binary.

Detection Strategies

• Inspect VPN connection keyfiles for non-printable characters, particularly 0x0A and 0x0D bytes within quoted credential values.
• Monitor D-Bus activity on the org.freedesktop.NetworkManager.fortisslvpn interface for profile activations by unprivileged users.
• Alert on execve events where the parent is nm-fortisslvpn-service and the child is not openfortivpn or an expected helper.

Monitoring Recommendations

• Enable Linux audit rules (auditd) on /etc/NetworkManager/system-connections/ and on execution of nm-fortisslvpn-service.
• Forward NetworkManager and systemd journal logs to a centralized SIEM for correlation across hosts.
• Baseline the expected process tree for VPN activation and alert on deviations.

How to Mitigate CVE-2026-91839

Immediate Actions Required

• Apply vendor patches for NetworkManager-fortisslvpn as soon as they are published by your Linux distribution.
• Remove or disable the NetworkManager-fortisslvpn package on hosts that do not require FortiSSLVPN connectivity.
• Audit existing system-connection profiles for CR/LF bytes in credential fields and delete suspicious profiles.

Patch Information

Track fixes through the Red Hat CVE-2026-91839 Advisory and the upstream GNOME Work Item #80. The upstream fix neutralizes CR/LF characters in credential fields before writing the backend configuration. Distribution-specific package versions are tracked in the Red Hat Bug Report #2533640.

Workarounds

• Restrict which users can create or activate NetworkManager VPN profiles via PolicyKit (polkit) rules targeting org.freedesktop.NetworkManager.settings.modify.system and org.freedesktop.NetworkManager.network-control.
• Uninstall NetworkManager-fortisslvpn on multi-user systems where VPN activation is not required for standard users.
• Enforce mandatory access control (SELinux or AppArmor) profiles that constrain nm-fortisslvpn-service from executing unexpected binaries.

# Example PolicyKit rule restricting VPN modification to the wheel group
# /etc/polkit-1/rules.d/50-nm-vpn.rules
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.NetworkManager.settings.modify.system" &&
        !subject.isInGroup("wheel")) {
        return polkit.Result.NO;
    }
});