CVE-2026-91838: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-91838 is a local privilege escalation vulnerability in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager, caused by OS command injection via shell metacharacters in VPN connection profile fields. A local unprivileged user can embed special characters into fields such as CA certificate or proxy settings, which are then passed unescaped to the pppd daemon running with root privileges, resulting in arbitrary command execution as root. The CVE was reported by Andreas Gabriel Berbescu and published on September 15, 2026. It is classified as HIGH severity (CWE-78) (Red Hat CVE, Red Hat Bugzilla).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command — OS Command Injection). When a VPN connection profile is activated, NetworkManager-sstp constructs command-line arguments for the pppd daemon using user-controlled fields (e.g., CA certificate path, proxy settings) without properly sanitizing or escaping shell metacharacters. Because pppd runs with root privileges, any injected shell metacharacters (e.g., ;, $(), &&) are interpreted by the shell, allowing arbitrary command execution. Exploitation requires local access and the ability to create or modify a VPN connection profile, then trigger its activation (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation grants a local unprivileged attacker root-level code execution on the affected system, enabling full system compromise. The attacker can read or modify any files, execute unauthorized OS commands, hide activities, crash or restart services, and access or alter application data. Since commands execute in the context of the pppd daemon (root), the attacker effectively gains complete control over the host (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of publication. The CVE status is listed as "Reserved" and the bug is marked "NEW" with no confirmed active exploitation. Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. No EPSS score or CISA KEV catalog entry has been identified for this CVE (Red Hat CVE, Red Hat Bugzilla).

1. Local Access: Obtain a local unprivileged user account on a Linux system with the NetworkManager-sstp package installed.
2. Create Malicious VPN Profile: Using NetworkManager tools (e.g., nmcli or the GUI), create a new SSTP VPN connection profile.
3. Inject Shell Metacharacters: In a vulnerable profile field such as the CA certificate path or proxy settings, embed shell metacharacters and a malicious payload (e.g., ; id > /tmp/pwned # or $(malicious_command)).
4. Activate the VPN Connection: Trigger activation of the malicious VPN profile (e.g., nmcli connection up <profile_name>).
5. Command Execution as Root: NetworkManager-sstp passes the unescaped field value to pppd, which runs as root. The shell metacharacters cause the injected command to execute with root privileges, achieving local privilege escalation (Red Hat CVE, Red Hat Bugzilla).

• Logs: System logs (e.g., /var/log/syslog, journalctl) showing pppd invocations with unusual or malformed arguments containing shell metacharacters (;, $(), &&, |).
• Process: Unexpected child processes spawned by pppd (e.g., /bin/bash, sh, python, curl, wget) with root privileges.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) by root-owned processes shortly after a VPN connection activation event.
• NetworkManager Logs: Entries in NetworkManager logs (journalctl -u NetworkManager) referencing SSTP VPN profile activation with anomalous field values.
• VPN Profiles: Presence of SSTP VPN connection profiles with unusual characters in CA certificate, proxy, or other configuration fields (inspect via nmcli connection show <name>).

Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product, so no Red Hat patch is available or required. The primary workaround is to remove the NetworkManager-sstp package if SSTP VPN functionality is not needed: sudo dnf remove NetworkManager-sstp. If SSTP VPN is required, restrict local user access to VPN profile creation and activation, and monitor for suspicious VPN profile configurations. Upstream maintainers of NetworkManager-sstp should apply proper escaping or sanitization of all user-controlled fields before passing them to pppd (Red Hat CVE).

Red Hat Product Security acknowledged the report and credited Andreas Gabriel Berbescu for responsible disclosure. Red Hat explicitly noted that no currently supported Red Hat product is affected, and the bug is tracked as a security response item. No significant broader community, researcher, or media commentary has been identified beyond the Red Hat advisory and Bugzilla entry (Red Hat CVE, Red Hat Bugzilla).