CVE-2026-10805

EUVD-2026-34207

04.06.2026, 06:16

A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.

OS Command Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.7 MEDIUM	LOCAL	HIGH	LOW	CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 5.88%

Debian Releases

Debian Product

Codename

network-manager

bookworm	ignored
bullseye	ignored
forky	1.58.1-1 fixed
sid	1.58.1-1 fixed
trixie	ignored

Ubuntu Releases

Ubuntu Product

Codename

network-manager

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
questing	ignored
resolute	needs-triage
xenial	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

NetworkManager

suse enterprise desktop 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise sap 15 SP4	1.32.12-150400.3.6.1 fixed
suse enterprise sap 15 SP5	1.38.6-150500.3.10.1 fixed
suse enterprise sap 15 SP6	1.44.2-150600.3.10.1 fixed
suse enterprise sap 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise server 15 SP4	1.32.12-150400.3.6.1 fixed
suse enterprise server 15 SP5	1.38.6-150500.3.10.1 fixed
suse enterprise server 15 SP6	1.44.2-150600.3.10.1 fixed
suse enterprise server 15 SP7	1.44.2-150600.3.10.1 fixed

NetworkManager-bluetooth

suse enterprise desktop 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise sap 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise server 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise workstation 15 SP7	1.44.2-150600.3.10.1 fixed

NetworkManager-cloud-setup

suse enterprise desktop 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise sap 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise server 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise workstation 15 SP7	1.44.2-150600.3.10.1 fixed

NetworkManager-devel

suse enterprise desktop 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise sap 12 SP5	1.0.12-13.17.1 fixed
suse enterprise sap 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise server 12 SP5	1.0.12-13.17.1 fixed
suse enterprise server 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise workstation 15 SP7	1.44.2-150600.3.10.1 fixed

NetworkManager-lang

suse enterprise desktop 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise sap 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise server 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise workstation 15 SP7	1.44.2-150600.3.10.1 fixed

NetworkManager-pppoe

suse enterprise desktop 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise sap 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise server 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise workstation 15 SP7	1.44.2-150600.3.10.1 fixed

NetworkManager-tui

suse enterprise desktop 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise sap 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise server 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise workstation 15 SP7	1.44.2-150600.3.10.1 fixed

NetworkManager-wwan

suse enterprise desktop 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise sap 15 SP5	1.38.6-150500.3.10.1 fixed
suse enterprise sap 15 SP6	1.44.2-150600.3.10.1 fixed
suse enterprise sap 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise server 15 SP5	1.38.6-150500.3.10.1 fixed
suse enterprise server 15 SP6	1.44.2-150600.3.10.1 fixed
suse enterprise server 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise workstation 15 SP7	1.44.2-150600.3.10.1 fixed

libnm-glib-vpn1

suse enterprise sap 12 SP5	1.0.12-13.17.1 fixed
suse enterprise server 12 SP3	1.0.12-13.17.1 fixed
suse enterprise server 12 SP5	1.0.12-13.17.1 fixed

libnm-glib4

suse enterprise sap 12 SP5	1.0.12-13.17.1 fixed
suse enterprise server 12 SP3	1.0.12-13.17.1 fixed
suse enterprise server 12 SP5	1.0.12-13.17.1 fixed

libnm-util2

suse enterprise sap 12 SP5	1.0.12-13.17.1 fixed
suse enterprise server 12 SP3	1.0.12-13.17.1 fixed
suse enterprise server 12 SP5	1.0.12-13.17.1 fixed

libnm0

suse enterprise desktop 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise sap 12 SP5	1.0.12-13.17.1 fixed
suse enterprise sap 15 SP4	1.32.12-150400.3.6.1 fixed
suse enterprise sap 15 SP5	1.38.6-150500.3.10.1 fixed
suse enterprise sap 15 SP6	1.44.2-150600.3.10.1 fixed
suse enterprise sap 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise server 12 SP3	1.0.12-13.17.1 fixed
suse enterprise server 12 SP5	1.0.12-13.17.1 fixed
suse enterprise server 15 SP4	1.32.12-150400.3.6.1 fixed
suse enterprise server 15 SP5	1.38.6-150500.3.10.1 fixed
suse enterprise server 15 SP6	1.44.2-150600.3.10.1 fixed
suse enterprise server 15 SP7	1.44.2-150600.3.10.1 fixed

typelib-1_0-NM-1_0

suse enterprise desktop 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise sap 12 SP5	1.0.12-13.17.1 fixed
suse enterprise sap 15 SP4	1.32.12-150400.3.6.1 fixed
suse enterprise sap 15 SP5	1.38.6-150500.3.10.1 fixed
suse enterprise sap 15 SP6	1.44.2-150600.3.10.1 fixed
suse enterprise sap 15 SP7	1.44.2-150600.3.10.1 fixed
suse enterprise server 12 SP5	1.0.12-13.17.1 fixed
suse enterprise server 15 SP4	1.32.12-150400.3.6.1 fixed
suse enterprise server 15 SP5	1.38.6-150500.3.10.1 fixed
suse enterprise server 15 SP6	1.44.2-150600.3.10.1 fixed
suse enterprise server 15 SP7	1.44.2-150600.3.10.1 fixed

typelib-1_0-NMClient-1_0

suse enterprise sap 12 SP5	1.0.12-13.17.1 fixed
suse enterprise server 12 SP3	1.0.12-13.17.1 fixed
suse enterprise server 12 SP5	1.0.12-13.17.1 fixed

typelib-1_0-NetworkManager-1_0

suse enterprise sap 12 SP5	1.0.12-13.17.1 fixed
suse enterprise server 12 SP3	1.0.12-13.17.1 fixed
suse enterprise server 12 SP5	1.0.12-13.17.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

NetworkManager

RHEL 8	1:1.40.16-21.el8_10 fixed
RHEL 8.4 AUS	1:1.30.0-19.el8_4.1 fixed
RHEL 8.6 AUS	1:1.36.0-18.el8_6.1 fixed
RHEL 8.8 E4S	1:1.40.16-10.el8_8.1 fixed
RHEL 8.8 TUS	1:1.40.16-10.el8_8.1 fixed
RHEL 9	1:1.54.3-5.el9_8 fixed

NetworkManager-adsl

RHEL 8	1:1.40.16-21.el8_10 fixed
RHEL 8.4 AUS	1:1.30.0-19.el8_4.1 fixed
RHEL 8.6 AUS	1:1.36.0-18.el8_6.1 fixed
RHEL 8.8 E4S	1:1.40.16-10.el8_8.1 fixed
RHEL 8.8 TUS	1:1.40.16-10.el8_8.1 fixed
RHEL 9	1:1.54.3-5.el9_8 fixed

NetworkManager-bluetooth

RHEL 8	1:1.40.16-21.el8_10 fixed
RHEL 8.4 AUS	1:1.30.0-19.el8_4.1 fixed
RHEL 8.6 AUS	1:1.36.0-18.el8_6.1 fixed
RHEL 8.8 E4S	1:1.40.16-10.el8_8.1 fixed
RHEL 8.8 TUS	1:1.40.16-10.el8_8.1 fixed
RHEL 9	1:1.54.3-5.el9_8 fixed

NetworkManager-cloud-setup

RHEL 8	1:1.40.16-21.el8_10 fixed
RHEL 8.4 AUS	1:1.30.0-19.el8_4.1 fixed
RHEL 8.6 AUS	1:1.36.0-18.el8_6.1 fixed
RHEL 8.8 E4S	1:1.40.16-10.el8_8.1 fixed
RHEL 8.8 TUS	1:1.40.16-10.el8_8.1 fixed
RHEL 9	1:1.54.3-5.el9_8 fixed

NetworkManager-config-connectivity-redhat

RHEL 8	1:1.40.16-21.el8_10 fixed
RHEL 8.4 AUS	1:1.30.0-19.el8_4.1 fixed
RHEL 8.6 AUS	1:1.36.0-18.el8_6.1 fixed
RHEL 8.8 E4S	1:1.40.16-10.el8_8.1 fixed
RHEL 8.8 TUS	1:1.40.16-10.el8_8.1 fixed
RHEL 9	1:1.54.3-5.el9_8 fixed

NetworkManager-config-server

RHEL 8	1:1.40.16-21.el8_10 fixed
RHEL 8.4 AUS	1:1.30.0-19.el8_4.1 fixed
RHEL 8.6 AUS	1:1.36.0-18.el8_6.1 fixed
RHEL 8.8 E4S	1:1.40.16-10.el8_8.1 fixed
RHEL 8.8 TUS	1:1.40.16-10.el8_8.1 fixed
RHEL 9	1:1.54.3-5.el9_8 fixed

NetworkManager-dispatcher-routing-rules

RHEL 8	1:1.40.16-21.el8_10 fixed
RHEL 8.4 AUS	1:1.30.0-19.el8_4.1 fixed
RHEL 8.6 AUS	1:1.36.0-18.el8_6.1 fixed
RHEL 8.8 E4S	1:1.40.16-10.el8_8.1 fixed
RHEL 8.8 TUS	1:1.40.16-10.el8_8.1 fixed
RHEL 9	1:1.54.3-5.el9_8 fixed

NetworkManager-initscripts-updown

RHEL 8	1:1.40.16-21.el8_10 fixed
RHEL 8.6 AUS	1:1.36.0-18.el8_6.1 fixed
RHEL 8.8 E4S	1:1.40.16-10.el8_8.1 fixed
RHEL 8.8 TUS	1:1.40.16-10.el8_8.1 fixed
RHEL 9	1:1.54.3-5.el9_8 fixed

NetworkManager-libnm

RHEL 8	1:1.40.16-21.el8_10 fixed
RHEL 8.4 AUS	1:1.30.0-19.el8_4.1 fixed
RHEL 8.6 AUS	1:1.36.0-18.el8_6.1 fixed
RHEL 8.8 E4S	1:1.40.16-10.el8_8.1 fixed
RHEL 8.8 TUS	1:1.40.16-10.el8_8.1 fixed
RHEL 9	1:1.54.3-5.el9_8 fixed

NetworkManager-libnm-devel

RHEL 8	1:1.40.16-21.el8_10 fixed
RHEL 9	1:1.54.3-5.el9_8 fixed

NetworkManager-ovs

RHEL 8	1:1.40.16-21.el8_10 fixed
RHEL 8.4 AUS	1:1.30.0-19.el8_4.1 fixed
RHEL 8.6 AUS	1:1.36.0-18.el8_6.1 fixed
RHEL 8.8 E4S	1:1.40.16-10.el8_8.1 fixed
RHEL 8.8 TUS	1:1.40.16-10.el8_8.1 fixed
RHEL 9	1:1.54.3-5.el9_8 fixed

NetworkManager-ppp

RHEL 8	1:1.40.16-21.el8_10 fixed
RHEL 8.4 AUS	1:1.30.0-19.el8_4.1 fixed
RHEL 8.6 AUS	1:1.36.0-18.el8_6.1 fixed
RHEL 8.8 E4S	1:1.40.16-10.el8_8.1 fixed
RHEL 8.8 TUS	1:1.40.16-10.el8_8.1 fixed
RHEL 9	1:1.54.3-5.el9_8 fixed

NetworkManager-team

RHEL 8	1:1.40.16-21.el8_10 fixed
RHEL 8.4 AUS	1:1.30.0-19.el8_4.1 fixed
RHEL 8.6 AUS	1:1.36.0-18.el8_6.1 fixed
RHEL 8.8 E4S	1:1.40.16-10.el8_8.1 fixed
RHEL 8.8 TUS	1:1.40.16-10.el8_8.1 fixed
RHEL 9	1:1.54.3-5.el9_8 fixed

NetworkManager-tui

RHEL 8	1:1.40.16-21.el8_10 fixed
RHEL 8.4 AUS	1:1.30.0-19.el8_4.1 fixed
RHEL 8.6 AUS	1:1.36.0-18.el8_6.1 fixed
RHEL 8.8 E4S	1:1.40.16-10.el8_8.1 fixed
RHEL 8.8 TUS	1:1.40.16-10.el8_8.1 fixed
RHEL 9	1:1.54.3-5.el9_8 fixed

NetworkManager-wifi

RHEL 8	1:1.40.16-21.el8_10 fixed
RHEL 8.4 AUS	1:1.30.0-19.el8_4.1 fixed
RHEL 8.6 AUS	1:1.36.0-18.el8_6.1 fixed
RHEL 8.8 E4S	1:1.40.16-10.el8_8.1 fixed
RHEL 8.8 TUS	1:1.40.16-10.el8_8.1 fixed
RHEL 9	1:1.54.3-5.el9_8 fixed

NetworkManager-wwan

RHEL 8	1:1.40.16-21.el8_10 fixed
RHEL 8.4 AUS	1:1.30.0-19.el8_4.1 fixed
RHEL 8.6 AUS	1:1.36.0-18.el8_6.1 fixed
RHEL 8.8 E4S	1:1.40.16-10.el8_8.1 fixed
RHEL 8.8 TUS	1:1.40.16-10.el8_8.1 fixed
RHEL 9	1:1.54.3-5.el9_8 fixed

Common Weakness Enumeration

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References

https://access.redhat.com/errata/RHSA-2026:58555

https://access.redhat.com/errata/RHSA-2026:58572

https://access.redhat.com/errata/RHSA-2026:61239

https://access.redhat.com/errata/RHSA-2026:61243

https://access.redhat.com/errata/RHSA-2026:61244

https://access.redhat.com/errata/RHSA-2026:61341

https://access.redhat.com/errata/RHSA-2026:61572

https://access.redhat.com/errata/RHSA-2026:61580

https://access.redhat.com/security/cve/CVE-2026-10805

https://bugzilla.redhat.com/show_bug.cgi?id=2484613