p PatchFirst

CVE-2026-91840

CVE-2026-91840 · Networkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn username

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary program with root privileges when the malicious VPN connection is activated.

CVSS 7.8 · High · EPSS 0.2%

Published
Updated

Stack: system

Affected products and versions

  • networkmanager-vpnc

    Versions
    • ≥ 0: Affected (semver)

    No fix published

  • network-manager-vpnc Debian:12

    Versions
    • 1.2.8-4
    • 1.2.8-5
    • 1.2.8-6
    • 1.2.8-7
    • 1.2.8-8
    • 1.4.0-1
    • 1.4.0-2
    • 1.4.0-3
    • 1.4.0-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • network-manager-vpnc Debian:13

    Versions
    • 1.4.0-2
    • 1.4.0-3
    • 1.4.0-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • network-manager-vpnc Ubuntu:16.04:LTS

    Versions
    • 0.9.10.0-1ubuntu1
    • 1.0.8-1ubuntu1
    • 1.1.93-1
    • 1.1.93-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • network-manager-vpnc Ubuntu:18.04:LTS

    Versions
    • 1.2.4-4
    • 1.2.4-6
    • 1.2.4-6ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • network-manager-vpnc Ubuntu:20.04:LTS

    Versions
    • 1.2.6-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • network-manager-vpnc Ubuntu:22.04:LTS

    Versions
    • 1.2.6-3
    • 1.2.6-4
    • 1.2.8-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • network-manager-vpnc Ubuntu:24.04:LTS

    Versions
    • 1.2.8-5
    • 1.2.8-7
    • 1.2.8-7build1
    • 1.2.8-7build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • network-manager-vpnc Ubuntu:26.10

    Versions
    • 1.4.0-3build1
    • 1.4.0-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • network-manager-vpnc Ubuntu:26.04:LTS

    Versions
    • 1.4.0-3
    • 1.4.0-3build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →