CVE-2026-105429 NetBird CVE debrief

Who should care

System administrators and users of NetBird clients on Linux, macOS, Windows, and FreeBSD should assess exposure and update to version 0.74.7 or later. Defenders should prioritize updating to version 0.74.7 or later and monitoring SSH configuration files for suspicious activity.

Why it matters

CVE-2026-105429 allows a malicious peer to inject arbitrary SSH configuration directives, including exec commands, on NetBird client hosts. Defenders should prioritize updating to version 0.74.7 or later and monitoring SSH configuration files for suspicious activity.

• Local command execution on affected NetBird client hosts
• Potential for lateral movement within networks
• Need for verification of SSH configuration manager security
• Priority for updating to fixed version 0.74.7

Technical summary

The NetBird client SSH configuration manager is vulnerable to improper neutralization of special elements, allowing a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The vulnerability exists in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6. The client writes a system-wide OpenSSH drop-in file that embeds each peer FQDN or hostname inside a double-quoted Match host directive without escaping. A peer name containing a double quote breaks out of the quoted context and injects arbitrary SSH configuration directives, including exec commands, which run locally as any user on the host the next time that

Defensive priority

High

Recommended defensive actions

• Review and update NetBird client to version 0.74.7 or later
• Verify SSH configuration manager for proper neutralization of special elements
• Monitor system-wide OpenSSH drop-in files for suspicious activity
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. The vulnerability allows a malicious peer to inject arbitrary SSH configuration directives, including exec commands, on NetBird client hosts. Defenders should prioritize updating to version 0.74.7 or later and monitoring SSH configuration files for suspicious activity. The CVE record was published on 2026-10-14T04:33:44.856Z and has not been modified since then. The source item provides additional The

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.