Local Privilege Escalation Vulnerability in NetworkManager - CVE-2026-10805
Summary
RLSA-2026:58555: Moderate: NetworkManager security update. Affects NetworkManager versions < 1:1.40.16-21.el8_10. Fixed in 1:1.40.16-21.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NetworkManager is a crucial system network service designed to manage network devices and connections, ensuring active network connectivity across various types of connections including Ethernet, wireless, mobile broadband (WWAN), and PPPoE. It also supports VPN integration with multiple services, making it a vital component for network management in Rocky Linux environments. However, a recent vulnerability has been identified that could allow local users to escalate their privileges through malformed MUD URLs in the dhclient backend.
Vulnerability Detail
The vulnerability, identified as CVE-2026-10805, arises from improper handling of malformed Manufacturer Usage Description (MUD) URLs within the dhclient backend of NetworkManager. This flaw could potentially allow a local attacker to gain elevated privileges, compromising the security of the system. The implications of this vulnerability are significant, as it could lead to unauthorized access and control over system resources, thereby affecting the integrity and confidentiality of the system.
How To Fix
Minimum fixed version
1:1.40.16-21.el8_10
This is the first release that contains the fix.
sudo dnf update NetworkManagerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to restrict access to the affected system and monitor for any suspicious activities until the patch is applied. Additionally, consider disabling the dhclient backend if it is not in use.
Conclusion
The identified vulnerability in NetworkManager (CVE-2026-10805) poses a moderate risk of local privilege escalation. It is crucial for users to update their systems to the patched version to mitigate potential risks. Regular monitoring and using tools like Vulert can help maintain security against such vulnerabilities.
See every vulnerability recorded for NetworkManager →
FAQ
CVE-2026-10805 is a vulnerability in NetworkManager that allows local privilege escalation through malformed MUD URLs in the dhclient backend.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If exploited, this vulnerability could allow an attacker to gain elevated privileges, leading to unauthorized access and control over system resources.
Run the command 'sudo dnf update NetworkManager' on Rocky Linux 8 to update to the patched version.
Yes, you can restrict access to the affected system and disable the dhclient backend if it is not in use until the patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for NetworkManager.
