CVE-2026-10805 Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend
Local attackers can escalate privileges via command injection in NetworkManager's dhclient backend when processing malformed MUD URLs, requiring non-default configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-10805?
CVE-2026-10805 is a medium-severity command injection vulnerability in Red Hat Multicluster Engine for Kubernetes, published on 4 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.
Weakness: CWE-78
Which versions are affected by CVE-2026-10805?
Linux distribution packages (40)
NetworkManager AlmaLinux:8 | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-adsl AlmaLinux:8 | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-bluetooth AlmaLinux:8 | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-cloud-setup AlmaLinux:8 | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-config-connectivity-redhat AlmaLinux:8 | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-config-server AlmaLinux:8 | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-dispatcher-routing-rules AlmaLinux:8 | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-initscripts-updown AlmaLinux:8 | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-libnm AlmaLinux:8 | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-libnm-devel AlmaLinux:8 | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-ovs AlmaLinux:8 | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-ppp AlmaLinux:8 | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-team AlmaLinux:8 | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-tui AlmaLinux:8 | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-wifi AlmaLinux:8 | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-wwan AlmaLinux:8 | All versions | 1:1.40.16-21.el8_10 |
NetworkManager AlmaLinux:9 | All versions | 1:1.54.3-5.el9_8 |
NetworkManager-adsl AlmaLinux:9 | All versions | 1:1.54.3-5.el9_8 |
NetworkManager-bluetooth AlmaLinux:9 | All versions | 1:1.54.3-5.el9_8 |
NetworkManager-cloud-setup AlmaLinux:9 | All versions | 1:1.54.3-5.el9_8 |
NetworkManager-config-connectivity-redhat AlmaLinux:9 | All versions | 1:1.54.3-5.el9_8 |
NetworkManager-config-server AlmaLinux:9 | All versions | 1:1.54.3-5.el9_8 |
NetworkManager-dispatcher-routing-rules AlmaLinux:9 | All versions | 1:1.54.3-5.el9_8 |
NetworkManager-initscripts-updown AlmaLinux:9 | All versions | 1:1.54.3-5.el9_8 |
NetworkManager-libnm AlmaLinux:9 | All versions | 1:1.54.3-5.el9_8 |
NetworkManager-libnm-devel AlmaLinux:9 | All versions | 1:1.54.3-5.el9_8 |
NetworkManager-ovs AlmaLinux:9 | All versions | 1:1.54.3-5.el9_8 |
NetworkManager-ppp AlmaLinux:9 | All versions | 1:1.54.3-5.el9_8 |
NetworkManager-team AlmaLinux:9 | All versions | 1:1.54.3-5.el9_8 |
NetworkManager-tui AlmaLinux:9 | All versions | 1:1.54.3-5.el9_8 |
NetworkManager-wifi AlmaLinux:9 | All versions | 1:1.54.3-5.el9_8 |
NetworkManager-wwan AlmaLinux:9 | All versions | 1:1.54.3-5.el9_8 |
NetworkManager-adsl-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-bluetooth-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-cloud-setup Red Hat:enterprise_linux:8::appstream | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-cloud-setup-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-libnm-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:1.40.16-21.el8_10 |
NetworkManager-ovs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:1.40.16-21.el8_10 |
How do I fix CVE-2026-10805?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-10805 being exploited?
There is no known exploitation of CVE-2026-10805 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:58555, ALSA-2026:58572, CLSA-2026-1787819848, CLSA-2026-1788271382, DEBIAN-CVE-2026-10805, GHSA-rwc7-7qq8-w477 and 16 more.