CVE-2026-10805

EUVD-2026-34207
A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.7 MEDIUM
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 7.22%
Debian logo
Debian Releases
Debian Product
Codename
network-manager
bookworm
ignored
bullseye
ignored
forky
1.58.0-2
fixed
sid
1.58.0-2
fixed
trixie
ignored
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
network-manager
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
xenial
needs-triage
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
NetworkManager
RHEL 8
1:1.40.16-21.el8_10
fixed
RHEL 8.8 TUS
1:1.40.16-10.el8_8.1
fixed
RHEL 9
1:1.54.3-5.el9_8
fixed
NetworkManager-adsl
RHEL 8
1:1.40.16-21.el8_10
fixed
RHEL 8.8 TUS
1:1.40.16-10.el8_8.1
fixed
RHEL 9
1:1.54.3-5.el9_8
fixed
NetworkManager-bluetooth
RHEL 8
1:1.40.16-21.el8_10
fixed
RHEL 8.8 TUS
1:1.40.16-10.el8_8.1
fixed
RHEL 9
1:1.54.3-5.el9_8
fixed
NetworkManager-cloud-setup
RHEL 8
1:1.40.16-21.el8_10
fixed
RHEL 8.8 TUS
1:1.40.16-10.el8_8.1
fixed
RHEL 9
1:1.54.3-5.el9_8
fixed
NetworkManager-config-connectivity-redhat
RHEL 8
1:1.40.16-21.el8_10
fixed
RHEL 8.8 TUS
1:1.40.16-10.el8_8.1
fixed
RHEL 9
1:1.54.3-5.el9_8
fixed
NetworkManager-config-server
RHEL 8
1:1.40.16-21.el8_10
fixed
RHEL 8.8 TUS
1:1.40.16-10.el8_8.1
fixed
RHEL 9
1:1.54.3-5.el9_8
fixed
NetworkManager-dispatcher-routing-rules
RHEL 8
1:1.40.16-21.el8_10
fixed
RHEL 8.8 TUS
1:1.40.16-10.el8_8.1
fixed
RHEL 9
1:1.54.3-5.el9_8
fixed
NetworkManager-initscripts-updown
RHEL 8
1:1.40.16-21.el8_10
fixed
RHEL 8.8 TUS
1:1.40.16-10.el8_8.1
fixed
RHEL 9
1:1.54.3-5.el9_8
fixed
NetworkManager-libnm
RHEL 8
1:1.40.16-21.el8_10
fixed
RHEL 8.8 TUS
1:1.40.16-10.el8_8.1
fixed
RHEL 9
1:1.54.3-5.el9_8
fixed
NetworkManager-libnm-devel
RHEL 8
1:1.40.16-21.el8_10
fixed
RHEL 9
1:1.54.3-5.el9_8
fixed
NetworkManager-ovs
RHEL 8
1:1.40.16-21.el8_10
fixed
RHEL 8.8 TUS
1:1.40.16-10.el8_8.1
fixed
RHEL 9
1:1.54.3-5.el9_8
fixed
NetworkManager-ppp
RHEL 8
1:1.40.16-21.el8_10
fixed
RHEL 8.8 TUS
1:1.40.16-10.el8_8.1
fixed
RHEL 9
1:1.54.3-5.el9_8
fixed
NetworkManager-team
RHEL 8
1:1.40.16-21.el8_10
fixed
RHEL 8.8 TUS
1:1.40.16-10.el8_8.1
fixed
RHEL 9
1:1.54.3-5.el9_8
fixed
NetworkManager-tui
RHEL 8
1:1.40.16-21.el8_10
fixed
RHEL 8.8 TUS
1:1.40.16-10.el8_8.1
fixed
RHEL 9
1:1.54.3-5.el9_8
fixed
NetworkManager-wifi
RHEL 8
1:1.40.16-21.el8_10
fixed
RHEL 8.8 TUS
1:1.40.16-10.el8_8.1
fixed
RHEL 9
1:1.54.3-5.el9_8
fixed
NetworkManager-wwan
RHEL 8
1:1.40.16-21.el8_10
fixed
RHEL 8.8 TUS
1:1.40.16-10.el8_8.1
fixed
RHEL 9
1:1.54.3-5.el9_8
fixed
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2026:58555
https://access.redhat.com/errata/RHSA-2026:58572
https://access.redhat.com/errata/RHSA-2026:61239
https://access.redhat.com/errata/RHSA-2026:61243
https://access.redhat.com/errata/RHSA-2026:61244
https://access.redhat.com/errata/RHSA-2026:61341
https://access.redhat.com/errata/RHSA-2026:61572
https://access.redhat.com/errata/RHSA-2026:61580
https://access.redhat.com/security/cve/CVE-2026-10805
https://bugzilla.redhat.com/show_bug.cgi?id=2484613