NetBird Client EUVD-2026-100813

Requires the attacker to control an enrolled or compromised peer in the victim's NetBird network whose FQDN or hostname - containing a double quote plus injected ssh_config directives - is distributed to the victim client, and the victim must run an affected NetBird desktop client (0.60.0 through 0.74.6) on Linux, macOS, Windows or FreeBSD with the SSH configuration feature active so that the 99-netbird.conf drop-in is written. The injected command does not execute on write; it only runs the next time a local user on the victim host invokes the ssh client, so exploitation is gated on that user action. Limiting factors: network/peer membership is required (not unauthenticated internet-facing), Android and iOS clients are not affected, and version 0.74.7 fully remediates by rejecting any peer name that is not a valid DNS label.

Signals point to a serious but conditional flaw rather than an emergency. The vendor CVSS 4.0 base score is 8.9 (High) with AV:N/AC:L and full vulnerable- and subsequent-system impact (VC/VI/VA/SC/SI/SA all High), reflecting that a successful injection yields arbitrary command execution and full host compromise. Two metrics temper this: PR:H means the attacker must already hold a privileged position as an enrolled or compromised peer in the victim's NetBird network, and AT:P plus the description's 'next time that user runs ssh' show exploitation is not instantaneous - it depends on a local user later invoking ssh. No EPSS score was provided, so statistical exploitation likelihood cannot be quantified. The CVE is not in CISA KEV and no public POC was supplied, so exploitation status is 'no public exploit identified at time of analysis' - note, however, that the vendor PR includes a working injection test case (ProxyCommand touch /tmp/pwned) that effectively documents the technique. Net: this is a genuine high-impact supply-chain-style issue for NetBird mesh operators, but the peer-membership prerequisite and the ssh-invocation trigger make it more suited to targeted lateral movement than mass opportunistic exploitation. One caveat: the vendor-supplied vector is CVSS 4.0 only; no independent 3.1 vector was provided, and my own assessment favors PR:L over the vendor's PR:H - verify the privilege required to register an arbitrary peer FQDN with the vendor.

An attacker who controls or compromises a peer in a NetBird network sets that peer's FQDN/hostname to a value containing a double quote followed by SSH directives such as an exec/ProxyCommand payload. When the victim's NetBird desktop client (0.60.0-0.74.6) syncs the peer list, it writes the unescaped name into the system-wide OpenSSH drop-in (/etc/ssh/ssh_config.d/99-netbird.conf), breaking out of the Match host quote and injecting the directive. The payload then runs locally as the victim user the next time that user invokes ssh; no public exploit is published, though the fix PR includes a proof-of-concept injection test.