CVE catalog

CVE-2026-91837

network-manager-iodine: CVE-2026-91837

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.14% · Oct 25, 2026

A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters (special characters that can execute commands) in the 'nameserver' value, an attacker can inject and execute arbitrary commands. These commands run with root privileges before the application drops its elevated permissions, leading to local privilege escalation.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannetwork-manager-iodinesid1.2.0-3.4vulnerable
Debiannetwork-manager-iodinetrixie1.2.0-3.3vulnerable
Debiannetwork-manager-iodinebookworm1.2.0-3.2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannetwork-manager-iodinesourcesid(unfixed)not yet assignedNot reported[1148114]
Debiannetwork-manager-iodinesourcetrixie(unfixed)not yet assignedNot reported[1148114]
Debiannetwork-manager-iodinesourcebookworm(unfixed)not yet assignedNot reported[1148114]

[Debian bug #1148114]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [network-manager-iodine]Affected
    Details (2)

    • 1.2.0-3.2 · amd64 · bookworm

      Affected

      dsa · network-manager-iodine · debian · bookworm

    • 1.2.0-3.2 · arm64 · bookworm

      Affected

      dsa · network-manager-iodine · debian · bookworm

  • [network-manager-iodine-gnome]Affected

    Source package: [network-manager-iodine]

    Details (2)

    • 1.2.0-3.2 · amd64 · bookworm

      Affected

      dsa · network-manager-iodine · debian · bookworm

    • 1.2.0-3.2 · arm64 · bookworm

      Affected

      dsa · network-manager-iodine · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]