CVE-2026-61477: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-61477 is a CRLF/newline injection vulnerability in libvirt's virtual network driver that can lead to arbitrary command execution as root. The network XML parser fails to strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes, which are then written verbatim into the dnsmasq configuration file. This allows a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives (e.g., dhcp-script), which dnsmasq executes as root when the virtual network is started. The vulnerability was published on August 6–7, 2026, and carries a CVSS v3.1 base score of 2.3 (Low) (Red Hat CVE, Github Advisory).

The root cause is CWE-93 (Improper Neutralization of CRLF Sequences / CRLF Injection). The libvirt network XML parser accepts XML numeric character references for line breaks (
 / 
) in DNS TXT record value attributes and SRV record domain/target attributes without sanitization. The network driver writes these values directly into the line-oriented dnsmasq configuration file as txt-record= or srv-host= directives; an embedded newline terminates the intended directive and begins a new one under attacker control — for example, dhcp-script=/bin/sh -c '' — which dnsmasq then executes as root when the virtual network is started. Exploitation requires local access and high privileges (specifically, permission to define and start virtual networks). A fix is available via a libvirt upstream commit (Red Hat Bugzilla, Github Advisory).

Successful exploitation allows a privileged local user to escalate to root-level command execution on the host system by injecting arbitrary dnsmasq configuration directives. Under the default libvirt deployment model, read-write access to the libvirt socket is already considered root-equivalent, so this is primarily a hardening concern. However, under non-default polkit fine-grained access control configurations that grant only network.write and network.start permissions, this vulnerability represents a meaningful privilege boundary violation that could enable full host compromise (Red Hat Bugzilla, Red Hat CVE).

There is no evidence of public proof-of-concept exploit code or in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD SSVC data classifies exploitation as "none" and automation as "no." The EPSS score is approximately 0.24% (15th percentile), indicating a low probability of exploitation in the near term (Github Advisory, Red Hat CVE).

1. Identify target environment: Confirm the target system runs libvirt with a non-default polkit configuration granting only network.write and network.start permissions to a non-root user, creating a meaningful privilege boundary.
2. Craft malicious network XML: As the privileged (but non-root) user, create a libvirt virtual network XML definition that includes a DNS TXT record or SRV record whose value attribute contains an embedded newline (e.g., using the XML numeric character reference 
) followed by a malicious dnsmasq directive such as dhcp-script=/path/to/malicious/script.
3. Define the virtual network: Use virsh net-define malicious-network.xml to register the crafted network definition with libvirt.
4. Start the virtual network: Execute virsh net-start malicious-network to trigger libvirt's network driver to generate the dnsmasq configuration file, writing the injected directive verbatim.
5. Achieve root code execution: When dnsmasq starts and processes the injected dhcp-script directive, it executes the attacker-specified script or command as root, completing the privilege escalation (Red Hat Bugzilla, Red Hat CVE).

• File System: Unexpected or modified dnsmasq configuration files in /var/lib/libvirt/network/ containing directives such as dhcp-script= pointing to unusual paths; presence of unauthorized scripts in locations referenced by such directives.
• Logs: libvirt logs (/var/log/libvirt/libvirtd.log) showing network definition or start events by non-root users; dnsmasq logs showing execution of unexpected dhcp-script commands; system auth logs showing privilege escalation to root from a libvirt-related process.
• Process: Unexpected child processes spawned by dnsmasq (e.g., /bin/sh, bash, python, curl, wget) running as root; unusual network connections originating from dnsmasq or its child processes.

A fix has been committed to the libvirt upstream repository (libvirt commit 3cfc779); users should update to a patched version of libvirt once available from their distribution. Red Hat notes that no mitigation meeting their deployment criteria is currently available for their products. As a compensating control, administrators should restrict libvirt socket access to trusted users only and avoid granting fine-grained polkit permissions (network.write + network.start) to untrusted users. Monitor official distribution security advisories (e.g., Ubuntu USN-8652-1, Red Hat errata) for patched package releases (Red Hat CVE, Github Advisory).

The vulnerability received routine coverage from vulnerability tracking services including VulDB and Vulners shortly after publication. Red Hat classified it as low severity and noted it is primarily a hardening issue under default configurations. No significant researcher commentary, vendor statements beyond Red Hat's advisory, or notable media coverage has been identified at this time (Red Hat CVE).