CVE-2026-91839

Networkmanager-fortisslvpn: networkmanager-fortisslvpn: local privilege escalation to root via crlf injection in vpn profile credentials

State: Published
Severity: 7.8 High
Published: Sep 25, 2026
Updated: Sep 28, 2026
Reserved: Sep 15, 2026

Read the record on cve.org

Description

A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed (CR/LF) characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile to inject additional configuration directives. This can lead to arbitrary code execution with root privileges when the crafted VPN connection is activated.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	fedora

Weaknesses

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

Affected Products

Product	Versions
NetworkManager-fortisslvpnGNOME	all versionsAffected

References

https://access.redhat.com/security/cve/CVE-2026-91839vdb-entry
RHBZ#2533640issue-tracking
https://gitlab.gnome.org/Archive/NetworkManager-fortisslvpn/-/work_items/80

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.