Andreas Gabriel Berbescu has reported several root privilege escalation vulnerabilities in various NetworkManager VPN plugins. If the VPN plugin is installed, then an unprivileged user can escalate to root by loading a malicious VPN configuration file:
- (CVE-2026-91837) network-manager-iodine: Option confusion reaches iodine’s pre-drop root shell
- (CVE-2026-91838) network-manager-sstp profile data reaches root pppd pty shell
- (CVE-2026-91839) NetworkManager-fortisslvpn credential newline injection permits local root code execution
- (CVE-2026-91840) NetworkManager-vpnc: Top-level VPN username newline injection reaches a root password helper
- (CVE-2026-91841) NetworkManager-vpnc: Incomplete fix of CVE-2018-10900
- September 25, 2026 Update: There is also CVE-2026-75131 and CVE-2026-75883 for NetworkManager-l2tp. I didn’t know about this because it is not a GNOME project.
While most obviously bad for multi-user systems, root privilege escalation is also a serious defense in depth problem for single user systems. You are vulnerable if you have the VPN plugin installed; it does not matter whether you actually use it or not.
These are not vulnerabilities in NetworkManager itself. The VPN plugins are each separate projects, with their own separate maintainers, hosted by GNOME rather than by freedesktop.org. The status of each project is a little different:
- The NetworkManager-vpnc and Network-Manager-fortisslvpn git repos have both been archived. Contributions are no longer accepted, and you should uninstall them immediately. NetworkManager-vpnc users should migrate to NetworkManager-libreswan, and NetworkManager-fortisslvpn users should migrate to NetworkManager-openconnect.
- network-manager-sstp is currently unmaintained, but it is not obsolete. If you are interested in SSTP, this project needs a new maintainer.
- network-manager-iodine is maintained, and the maintainer has created a merge request to resolve this issue.
For more information on NetworkManager VPN plugins, see Josephine’s VPN plugin overview and announcement.