EUVD-2026-87250
GHSA-p2g6-ffcc-pqqv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as local low-privileged user
-
DeliveryCreate/edit VPNC connection with newline in username
-
ExploitNewline injects directives into root helper input
-
ExecutionRoot helper parses attacker-controlled config
-
ImpactExecute with root privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization CRLF sequence sanitization
|
| Exploitation Conditions | Requires local access as an unprivileged user who has permission to create or modify a NetworkManager VPNC connection profile, and the NetworkManager-vpnc plugin must be installed and in use. Exploitation depends on injecting a newline (CRLF/LF) character into the username field so that the value crosses into the root-run vpnc password/helper process. Limiting factors: attack is local only (AV:L) - not remotely reachable - and needs the vpnc plugin present; no user interaction by a victim is required, and the attacker only needs their own low-privilege session. |
| Impact | This is a genuine local privilege-escalation issue that merits prompt patching on affected systems, though it is not a mass-exploitation emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: a local, low-privileged user who can create or edit a VPN connection injects a newline into the username field, which flows into a helper that runs as root, yielding full root compromise (C:H/I:H/A:H). No EPSS score, no CISA KEV listing, and no public POC were supplied, so exploitation is 'no public exploit identified at time of analysis' - meaning this is a real, high-technical-impact local flaw rather than an actively-exploited internet-facing threat. The one debatable metric is scope: NVD keeps S:U, but because the vulnerability crosses a trust boundary from an unprivileged user to a root helper, S:C is arguably defensible; this does not change the practical severity (root). No conflicting signals otherwise - the local attack vector matches the root-helper description well. |
| Exploit ScenarioDerived | A logged-in unprivileged user on a Linux workstation with NetworkManager-vpnc installed creates or edits a VPNC connection and sets a username value containing an embedded newline followed by attacker-chosen directives. When NetworkManager passes the connection data to the vpnc helper/password-handling process that runs as root, the injected line is interpreted as additional configuration, causing attacker-controlled behavior to execute with root privileges. No public exploit code was identified, but the technique mirrors the well-documented earlier NetworkManager-vpnc config-injection class and requires no user interaction beyond the attacker's own actions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 25, 2026
Local privilege escalation in the NetworkManager-vpnc plugin lets a low-privileged user who can create or edit VPNC connection profiles inject a newline character into the username field, causing that value to spill into the root-run vpnc password helper and ultimately execute with root privileges (CWE-93, CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack requires local access and an unprivileged account with write permission to NetworkManager connection profiles, plus the vpnc plugin installed and in use; no victim interaction is needed because the attacker only uses their own session. It is not remotely reachable and there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, making this a prompt-patching priority for affected Ubuntu/RHEL systems that ship the plugin rather than a mass-exploitation emergency.
Earlier versions of this analysis (1)
Newline injection into a root-privileged password helper on Ubuntu may allow a local, authenticated low-privileged user to gain root by supplying a crafted username whose embedded newline character is not neutralized before the helper processes it. Our independent assessment rates this CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, i.e. local access by a low-privileged user with no user interaction and high confidentiality, integrity and availability impact, but the vendor has published no CVSS score or vector, and no CWE, EPSS, KEV or POC signal was supplied, so the vector and prerequisites remain UNCONFIRMED pending Ubuntu's advisory. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so there is no evidence of confirmed active exploitation; the concern is that a successful trigger yields full root compromise rather than merely a local denial of service.
RemediationAI
No vendor-released patch identified at time of analysis, and the referenced upstream project sits in the GNOME GitLab archive namespace, so a fix may be slow or may require migration away from the plugin; confirm status against https://access.redhat.com/security/cve/CVE-2026-91840 and https://bugzilla.redhat.com/show_bug.cgi?id=2533642 and apply distribution updates as soon as they appear. Because no patched version is confirmed, prioritize compensating controls: if VPNC tunnels are not required, remove the plugin entirely (for example 'apt remove network-manager-vpnc' on Debian/Ubuntu or 'dnf remove NetworkManager-vpnc' on RHEL-family systems) - this fully closes the vector but breaks existing VPNC connections, which administrators must migrate to a maintained VPN flavor. Where the plugin must stay, use polkit/NetworkManager authorization rules to strip the ability of ordinary users to create or modify VPN connection profiles so that only root or a tightly controlled group can set the username field, and tighten filesystem permissions on /etc/NetworkManager/system-connections so unprivileged users cannot write profile files directly; the trade-off is that legitimate self-service VPN configuration is removed and must be handled by administrators. Additionally, audit existing connection profiles for usernames containing embedded newline or carriage-return characters as possible indicators of prior abuse, and log/monitor invocations of the vpnc password helper for unexpected arguments. Note that these are mitigations only - they do not replace a future vendor fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CRLF/newline injection (CWE-93) in GNOME's NetworkManager-vpnc VPN plugin, the component that feeds user-supplied VPNC connection parameters into the underlying vpnc client. NetworkManager keyfile connection profiles are line-oriented: properties are serialized as newline-delimited key=value entries, and the username field is written into that structure and later handed to helper processes - including the vpnc password helper, which runs with root privileges. Because the username is not neutralized for embedded LF/CRLF sequences, an attacker who controls the username can break out of the intended field boundary and inject additional lines or properties that are interpreted downstream by the root-context helper, converting a profile-editing capability into arbitrary root code execution. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the practical profile: local attack path, low complexity, low privileges required on the attacker's own account, no user interaction, and high confidentiality, integrity and availability impact within the same security scope. The upstream repository referenced in the advisory is hosted under the GNOME GitLab 'Archive' namespace, indicating the plugin is a legacy/archived component, which matters for how quickly a fix can be expected.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-privileged user editing a VPN profile (AV:L/PR:L/AC:L), no victim interaction (UI:N), injection reaches a root helper yielding full root control (C:H/I:H/A:H); S:U kept per NVD though S:C is arguable.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
2DescriptionCVE.org
[username newline injection reaches a root password helper]
Executive ViewAI
The NetworkManager-vpnc plugin, present on affected Ubuntu and RHEL systems, contains a high-severity local privilege escalation vulnerability that allows any authenticated local user to gain root access. This means an insider threat or any user with a local account could fully compromise the system, leading to data theft, malware installation, or lateral movement within the enterprise. Leadership should prioritize remediation because no vendor patch is available and the plugin is commonly deployed in managed environments.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or disable the NetworkManager-vpnc plugin if not required; restrict write access to NetworkManager connection profiles to root or trusted administrators; enforce SELinux or AppArmor confinement for the vpnc helper; monitor audit logs for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Exploit-DB