Severity by source
Local user with connection-config rights (PR:L, AV:L) triggers option confusion in a root helper for full root compromise (C/I/A:H); no scope change assumed, so S:U.
Lifecycle Timeline
2DescriptionCVE.org
[network-manager-iodine: Option confusion reaches iodine's pre-drop root shell]
AnalysisAI
Local privilege escalation in the NetworkManager iodine VPN plugin (network-manager-iodine) lets an authenticated local user obtain code execution as root through option confusion in the root-privileged nm-iodine-service. A user who is permitted (typically via polkit for an active session) to create or edit an iodine VPN connection can supply a connection property value that iodine's command-line parser interprets as an option flag instead of data, producing behaviour that runs while the service is still root and before iodine drops privileges to an unprivileged user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires: (1) a Linux host with the network-manager-iodine plugin installed; (2) a local user permitted (typically via polkit for an active session) to create or edit a NetworkManager iodine VPN connection; (3) the root-privileged nm-iodine-service constructing iodine's argument list from user-supplied connection properties without neutralizing values that look like options. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector, CWE, EPSS, KEV, SSVC, or POC signal is supplied in the input - only a one-line title and an Ubuntu vendor report - so raw scoring signals are ABSENT and must be inferred. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed version was identified in the supplied data at time of analysis, so the primary action is to track and apply the Ubuntu security notice for CVE-2026-91837 (ubuntu.com/security/CVE-2026-91837) and the upstream network-manager-iodine fix as soon as either is published; do not assume a specific version number until the advisory states one. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today