CVE-2026-91837 GNOME CVE debrief

Who should care

System administrators using NetworkManager-iodine should assess exposure and apply patches or mitigations. This includes verifying the presence of affected systems, reviewing system logs for suspicious activity, and ensuring that patches or updates are applied promptly. Additionally, security teams should monitor for potential exploitation attempts and review compensating controls for exposed systems while remediation is scheduled and verified. Operators,

Why it matters

CVE-2026-91837 allows local unprivileged users to escalate privileges by exploiting a vulnerability in NetworkManager-iodine. System administrators should verify and apply patches immediately.

• Local privilege escalation possible
• Arbitrary command execution with root privileges
• Potential for system compromise

Technical summary

The iodine VPN plugin for NetworkManager processes the 'nameserver' setting insecurely, allowing local unprivileged users to inject and execute arbitrary commands with root privileges. This occurs before the application drops its elevated permissions, leading to local privilege escalation. The vulnerability is due to inadequate handling of the 'nameserver' value when establishing an iodine VPN connection, which enables an attacker to execute commands with root privileges by embedding shell metacharacters in the 'nameserver' value.

Defensive priority

High priority for systems using NetworkManager-iodine; verify and apply patches immediately.

Recommended defensive actions

• Verify and apply patches for NetworkManager-iodine
• Restrict access to iodine VPN connections
• Monitor system logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in NetworkManager-iodine. Red Hat has a reference for this CVE. The iodine VPN plugin for NetworkManager processes the 'nameserver' setting insecurely, allowing local unprivileged users to inject and execute arbitrary commands with root privileges. System administrators should verify and apply patches immediately. The exploit involves embedding shell metacharacters in the 'nameserver' value when establishing an iodine VPN connection.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.