CVE catalog

CVE-2026-91840

network-manager-vpnc: CVE-2026-91840

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.19% · Oct 25, 2026

A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary program with root privileges when the malicious VPN connection is activated.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannetwork-manager-vpncsid1.4.0-4vulnerable
Debiannetwork-manager-vpnctrixie1.4.0-2vulnerable
Debiannetwork-manager-vpncbookworm1.2.8-4vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannetwork-manager-vpncsourcesid(unfixed)not yet assignedNot reported[1148113]
Debiannetwork-manager-vpncsourcetrixie(unfixed)not yet assignedNot reported[1148113]
Debiannetwork-manager-vpncsourcebookworm(unfixed)not yet assignedNot reported[1148113]

[Debian bug #1148113]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [network-manager-vpnc]Affected
    Details (2)

    • 1.2.8-4 · amd64 · bookworm

      Affected

      dsa · network-manager-vpnc · debian · bookworm

    • 1.2.8-4 · arm64 · bookworm

      Affected

      dsa · network-manager-vpnc · debian · bookworm

  • [network-manager-vpnc-gnome]Affected

    Source package: [network-manager-vpnc]

    Details (2)

    • 1.2.8-4 · amd64 · bookworm

      Affected

      dsa · network-manager-vpnc · debian · bookworm

    • 1.2.8-4 · arm64 · bookworm

      Affected

      dsa · network-manager-vpnc · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]