Vulnerability · Published Sep 25, 2026 · Assigned by fedora

CVE-2026-91838Networkmanager-sstp: networkmanager-sstp: local privilege escalation to root via shell injection in vpn profile fields

High 7.8

In plain English

A high-severity OS command injection in NetworkManager-sstp from GNOME. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.1%top 99.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped characters are then processed by the `pppd` daemon, which runs with root privileges, allowing the attacker to execute arbitrary commands with elevated permissions when a malicious VPN connection is activated.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	network-manager-sstp	no fix listed	DEBIAN-CVE-2026-91838
Debian:13	network-manager-sstp	no fix listed	DEBIAN-CVE-2026-91838
Ubuntu:22.04:LTS	network-manager-sstp	no fix listed	UBUNTU-CVE-2026-91838
Ubuntu:24.04:LTS	network-manager-sstp	no fix listed	UBUNTU-CVE-2026-91838
Ubuntu:26.04:LTS	network-manager-sstp	no fix listed	UBUNTU-CVE-2026-91838
Ubuntu:26.10	network-manager-sstp	no fix listed	UBUNTU-CVE-2026-91838

Affected products (as reported)

Vendor	Product	Versions
GNOME	NetworkManager-sstp	0 – before *

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://access.redhat.com/security/cve/CVE-2026-91838 vdb-entry, x_refsource_REDHAT
RHBZ#2533637 issue-tracking, x_refsource_REDHAT
https://gitlab.gnome.org/GNOME/network-manager-sstp/-/work_items/67