CVE-2026-91840: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-91840 is a local privilege escalation vulnerability in NetworkManager-vpnc, the vpnc VPN plugin for NetworkManager. By injecting a newline character into the VPN username field, a local unprivileged user can manipulate the vpnc configuration to execute an arbitrary program with root privileges when the malicious VPN connection is activated. The CVE was reported on September 15, 2026, and is currently in "Reserved" status. Red Hat has assessed that this vulnerability does not affect any currently supported Red Hat product. The vulnerability is estimated as HIGH severity (CWE-93) (Red Hat CVE, Red Hat Bugzilla).

The root cause is CWE-93 (Improper Neutralization of CRLF Sequences / CRLF Injection). The nm-vpnc-service component validates plugin-specific VPN configuration items for embedded newline characters but omits the top-level NMSettingVpn user-name property from this check. The unvalidated username is serialized verbatim into vpnc's configuration as an Xauth username directive. A local attacker can craft a VPN profile whose username contains a newline character followed by a Password helper directive, causing the root-privileged vpnc process to parse the injected directive and execute an attacker-chosen helper program with UID/EUID 0 when the connection is activated (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows a local unprivileged user to escalate privileges to root on the affected system. The attacker gains full control of the host, enabling arbitrary code execution as root, access to all sensitive data, and the ability to persist or pivot to other systems on the network. The integrity and confidentiality of the entire system are compromised (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The vulnerability requires local access to the system and the ability to create or modify a VPN profile, limiting the attack surface to authenticated local users. No EPSS score or CISA KEV catalog entry has been identified for this CVE. The CVE status remains "Reserved" (Red Hat CVE, Red Hat Bugzilla).

1. Gain local access: Obtain a local unprivileged user account on a system with NetworkManager-vpnc installed.
2. Create a malicious VPN profile: Using NetworkManager tools (e.g., nmcli or the GNOME network settings UI), create a new vpnc VPN connection profile.
3. Inject newline into username: Set the VPN username field to a value containing a newline character followed by a Password helper directive pointing to an attacker-controlled executable, e.g., legitimateuser\nPassword helper /tmp/malicious_script.
4. Prepare the payload: Place an attacker-controlled executable (e.g., a shell script that adds a backdoor or spawns a root shell) at the path specified in the injected Password helper directive.
5. Activate the VPN connection: Trigger activation of the malicious VPN connection (e.g., via nmcli connection up <profile>). The root-privileged vpnc process parses the injected directive and executes the attacker's helper program with UID/EUID 0.
6. Achieve root access: The attacker's payload runs as root, completing the privilege escalation (Red Hat Bugzilla, Red Hat CVE).

• Logs: System logs (e.g., /var/log/syslog, journalctl) showing unexpected processes spawned by the vpnc process with UID/EUID 0; entries indicating VPN connection activation by a non-root user followed by unusual child process execution.
• File System: Presence of unexpected executable scripts in world-writable directories (e.g., /tmp/) that could serve as Password helper payloads; new or modified VPN profile files in /etc/NetworkManager/system-connections/ with unusual username fields containing encoded newline characters.
• Process: Unusual processes running as root that were spawned by vpnc or nm-vpnc-service; unexpected shell processes (e.g., /bin/bash, /bin/sh) with EUID 0 not initiated by a privileged user.
• Network: Unexpected outbound connections from the host following VPN profile activation, potentially indicating post-exploitation activity.

Red Hat has determined that currently supported Red Hat products are not affected by this vulnerability. As a workaround, if vpnc VPN connections are not required, the NetworkManager-vpnc package can be removed using # dnf remove NetworkManager-vpnc. Organizations actively using vpnc-based VPN connections should monitor upstream GNOME/NetworkManager-vpnc project releases for a patched version and apply it when available. The vulnerability was reported by Andreas Gabriel Berbescu (Red Hat CVE).

Red Hat Product Security acknowledged the vulnerability and credited Andreas Gabriel Berbescu for the report. Red Hat has explicitly stated that no currently supported Red Hat product is affected, and the assessment may evolve with further analysis. No significant broader community or media reactions have been identified at this time (Red Hat CVE).