CVE-2026-19685
- Source
- https://cve.org/CVERecord?id=CVE-2026-19685
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19685.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-19685
- Downstream
- Published
- 2026-08-24T16:12:38.297Z
- Modified
- 2026-08-30T08:17:19.095257Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)
- Details
-
NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19685.json", "cwe_ids": [ "CWE-863" ], "cna_assigner": "redhat" }- References
-
- https://access.redhat.com/downloads/content/package-browser/
- https://access.redhat.com/security/cve/CVE-2026-19685
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19685.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-19685
- https://bugzilla.redhat.com/show_bug.cgi?id=2515042
- https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/a8e87381a3e70060abd721d9a347f42b2ba68e6e
- https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/e85cc46d0b36cdba50fe8411cc93d55a49ebfccf
- https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2513
Affected packages
Git / gitlab.freedesktop.org/networkmanager/networkmanager
Affected versions
0.*
0.7.997
0.8-rc1
0.8.995
0.8.996
0.8.997
0.8.998
0.8.999
0.8.9997
0.9-rc2
0.9-rc3
0.9.0
0.9.0-beta1
0.9.0-beta2
0.9.0-beta3
0.9.0-rc1
0.9.1.90
0.9.1.95
0.9.10-beta1
0.9.2
0.9.2-beta1
0.9.2-rc1
0.9.2.0
0.9.3.990
0.9.3.995
0.9.3.997
0.9.4-beta1
0.9.4-rc1
0.9.4.0
0.9.5.95
0.9.5.96
0.9.6-rc1
0.9.6-rc2
0.9.6.0
0.9.7.995
0.9.8-beta1
0.9.9.1
0.9.9.95
1.*
1.1.0-dev
1.10-rc1
1.10.0
1.11.1-dev
1.11.2-dev
1.11.3-dev
1.11.4-dev
1.12-rc1
1.12.0
1.13.1-dev
1.13.2-dev
1.13.3-dev
1.14-rc1
1.14.0
1.15.1-dev
1.15.2-dev
1.16-rc1
1.16-rc2
1.16.0
1.17.1-dev
1.17.2-dev
1.17.3-dev
1.18-rc1
1.18.0
1.19.1-dev
1.19.2-dev
1.19.3-dev
1.19.4-dev
1.19.5-dev
1.2-beta1
1.2-beta2
1.2-beta3
1.20-rc1
1.20.0
1.21.1-dev
1.21.2-dev
1.21.3-dev
1.22-rc1
1.22.0
1.23.1-dev
1.23.2-dev
1.24-rc1
1.24-rc2
1.24.0
1.25.1-dev
1.25.2-dev
1.26-rc1
1.26-rc2
1.26.0
1.27.1-dev
1.27.2-dev
1.27.3-dev
1.28-rc1
1.28-rc2
1.28.0
1.29.10-dev
1.29.11-dev
1.29.5-dev
1.29.6-dev
1.29.7-dev
1.29.8-dev
1.29.9-dev
1.3.0-dev
1.30-rc1
1.30.0
1.31.1-dev
1.31.2-dev
1.31.3-dev
1.31.4-dev
1.31.5-dev
1.32-rc1
1.32.0
1.33.1-dev
1.33.2-dev
1.33.3-dev
1.33.4-dev
1.34-rc1
1.34.0
1.35.5-dev
1.35.6-dev
1.35.7-dev
1.36-rc1
1.36-rc2
1.36-rc3
1.36.0
1.37.1-dev
1.37.2-dev
1.37.3-dev
1.38-rc1
1.38-rc2
1.38-rc3
1.38.0
1.39.10-dev
1.39.11-dev
1.39.12-dev
1.39.4-dev
1.39.5-dev
1.39.6-dev
1.39.7-dev
1.39.8-dev
1.39.9-dev
1.4-beta1
1.4-rc1
1.4.0
1.40-rc1
1.40.0
1.41.1-dev
1.41.2-dev
1.41.3-dev
1.41.4-dev
1.41.5-dev
1.41.6-dev
1.41.7-dev
1.41.8-dev
1.42-rc1
1.42-rc2
1.42.0
1.43.10-dev
1.43.11-dev
1.43.2-dev
1.43.3-dev
1.43.4-dev
1.43.5-dev
1.43.6-dev
1.43.7-dev
1.43.8-dev
1.43.9-dev
1.44-rc1
1.44.0
1.45.1-dev
1.45.10-dev
1.45.2-dev
1.45.3-dev
1.45.4-dev
1.45.5-dev
1.45.6-dev
1.45.7-dev
1.45.8-dev
1.45.9-dev
1.46-rc1
1.46-rc2
1.46.0
1.47.1-dev
1.47.2-dev
1.47.3-dev
1.47.4-dev
1.47.5-dev
1.48-rc1
1.48-rc2
1.48.0
1.49.1-dev
1.49.2-dev
1.49.3-dev
1.49.4-dev
1.49.5-dev
1.49.6-dev
1.5.1-dev
1.5.2-dev
1.5.3-dev
1.50-rc1
1.51.0-dev
1.51.1-dev
1.51.2-dev
1.51.3-dev
1.51.4-dev
1.51.5-dev
1.51.6-dev
1.51.7-dev
1.52-rc1
1.52.0
1.53.1-dev
1.53.2-dev
1.53.3-dev
1.53.4-dev
1.54-rc1
1.54-rc2
1.54-rc3
1.54.0
1.55.3-dev
1.55.4-dev
1.56-rc1
1.56-rc2
1.56.0
1.57.0-dev
1.57.2-dev
1.57.3-dev
1.57.4-dev
1.58-rc1
1.58.0
1.59.1-dev
1.6-rc1
1.6-rc2
1.6.0
1.7.1-dev
1.7.2-dev
1.8-rc1
1.8-rc2
1.8-rc3
1.8.0
1.9.1-dev
1.9.2-dev
1.9.3-dev
Database specific
vanir_signatures
[
{
"id": "CVE-2026-19685-0a979466",
"target": {
"function": "nm_supplicant_config_finalize",
"file": "src/core/supplicant/nm-supplicant-config.c"
},
"deprecated": false,
"digest": {
"function_hash": "145159171291297212891683533196812105408",
"length": 219.0
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@e85cc46d0b36cdba50fe8411cc93d55a49ebfccf",
"signature_type": "Function"
},
{
"id": "CVE-2026-19685-2118c9f2",
"target": {
"function": "build_supplicant_config",
"file": "src/core/devices/nm-device-macsec.c"
},
"deprecated": false,
"digest": {
"function_hash": "259529236032201701893813456867010636924",
"length": 1095.0
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@e85cc46d0b36cdba50fe8411cc93d55a49ebfccf",
"signature_type": "Function"
},
{
"id": "CVE-2026-19685-25630c4c",
"target": {
"file": "src/core/supplicant/tests/test-supplicant-config.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"192094200522568634799917146939641108753",
"35986309913432191779054339854951810827",
"330127736392905973739922338791577829106",
"135242038992761682977262356154059646936",
"239862937937422227332655683294415738535",
"12722408029060783089479416337474422760",
"36760545941963381177105979139449498074",
"279260874253138304574433985041065812271"
]
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@e85cc46d0b36cdba50fe8411cc93d55a49ebfccf",
"signature_type": "Line"
},
{
"id": "CVE-2026-19685-27b34bd6",
"target": {
"function": "nm_supplicant_config_add_setting_8021x",
"file": "src/core/supplicant/nm-supplicant-config.c"
},
"deprecated": false,
"digest": {
"function_hash": "82037035691844336975390809931311263840",
"length": 12533.0
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@a8e87381a3e70060abd721d9a347f42b2ba68e6e",
"signature_type": "Function"
},
{
"id": "CVE-2026-19685-34f79974",
"target": {
"file": "src/core/devices/nm-device-ethernet.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"105594499201680363859639340838517432393",
"169543012297798198893762027213168176979",
"194593763694249434481718665950438253326",
"144407561608257088540612801358899902165",
"129512692642452854665426768133744723308",
"123095454766501788601349359533952668206"
]
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@e85cc46d0b36cdba50fe8411cc93d55a49ebfccf",
"signature_type": "Line"
},
{
"id": "CVE-2026-19685-3e506358",
"target": {
"file": "src/core/devices/wifi/nm-device-wifi.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"138020986424767024995397273374778646648",
"7818520160349676932442906089611073765",
"286512336642953764004917295022702329958",
"130444268244926921798658501150218350091",
"226307233859425375053359901119758515945",
"98929306643111070594732999544101792854",
"202763131002476867656388172192641827110",
"227102287852699726361990474509741265502"
]
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@e85cc46d0b36cdba50fe8411cc93d55a49ebfccf",
"signature_type": "Line"
},
{
"id": "CVE-2026-19685-4a8533eb",
"target": {
"function": "main",
"file": "src/core/supplicant/tests/test-supplicant-config.c"
},
"deprecated": false,
"digest": {
"function_hash": "300193913610643695418521076935976148689",
"length": 898.0
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@a8e87381a3e70060abd721d9a347f42b2ba68e6e",
"signature_type": "Function"
},
{
"id": "CVE-2026-19685-4bc35547",
"target": {
"file": "src/core/devices/nm-device-macsec.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"105594499201680363859639340838517432393",
"163135608174103232400272991420049366278",
"182194782582735805989329087289616730686",
"21553565569734975674194481857373448007",
"298325480259718733363295672957797011849",
"319311318436673428109837467391198010597",
"98874305143220419126608457191785942084",
"88376417110386627803136755919466139907"
]
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@e85cc46d0b36cdba50fe8411cc93d55a49ebfccf",
"signature_type": "Line"
},
{
"id": "CVE-2026-19685-730b9dff",
"target": {
"function": "build_supplicant_config",
"file": "src/core/devices/wifi/nm-device-wifi.c"
},
"deprecated": false,
"digest": {
"function_hash": "159786281065627111442033359689300531159",
"length": 2226.0
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@e85cc46d0b36cdba50fe8411cc93d55a49ebfccf",
"signature_type": "Function"
},
{
"id": "CVE-2026-19685-88b0be2e",
"target": {
"file": "src/core/supplicant/nm-supplicant-config.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"211394372503342049276432827692257462436",
"147282773143083056145528497960064830458",
"34086765335806168154427917193215326737",
"197955478615885640852027867917921480468",
"50062830454482620406298128559525981332",
"203857118590952827461937869617904708998",
"99937694293195360767830735568465566632",
"314689191017643334104539745955236790711",
"200177930655389788861924861566757896867",
"58970070931949364574815286238723147884",
"173253388330485195233069310149729210028",
"288477642902559353961648606925184262162"
]
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@e85cc46d0b36cdba50fe8411cc93d55a49ebfccf",
"signature_type": "Line"
},
{
"id": "CVE-2026-19685-8f734829",
"target": {
"file": "src/core/supplicant/tests/test-supplicant-config.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"221311335059254097966688497372289787135",
"98194246498265983003758451891592838689",
"100922558182767297412977898913588256745",
"119213320237334219137604510354301131911",
"57083432585481717334940628639377023433",
"191771686705468620148265452630594072495"
]
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@a8e87381a3e70060abd721d9a347f42b2ba68e6e",
"signature_type": "Line"
},
{
"id": "CVE-2026-19685-9adaea18",
"target": {
"function": "nm_supplicant_config_new",
"file": "src/core/supplicant/nm-supplicant-config.c"
},
"deprecated": false,
"digest": {
"function_hash": "211714881624399835787747881298274490860",
"length": 179.0
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@e85cc46d0b36cdba50fe8411cc93d55a49ebfccf",
"signature_type": "Function"
},
{
"id": "CVE-2026-19685-b72aba48",
"target": {
"function": "build_supplicant_config",
"file": "src/core/devices/nm-device-ethernet.c"
},
"deprecated": false,
"digest": {
"function_hash": "107847956314728925129453179089630874546",
"length": 530.0
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@e85cc46d0b36cdba50fe8411cc93d55a49ebfccf",
"signature_type": "Function"
},
{
"id": "CVE-2026-19685-ce805a11",
"target": {
"file": "src/core/supplicant/nm-supplicant-config.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"338991373122982358114112965222874815121",
"129544198724283353498082500635508352954",
"41630307923938078328691701158477047814",
"312200590011322909747263501182863985840",
"224061740888039589066147768495709836100",
"29757161645418084169350506120636418477",
"290724674425429762203651340414184568696",
"114227854367430394191107386804874459363",
"193521834338102404278245367558923044336",
"251327347747781178860426367579354810848",
"11389874522721156375980909952617605630",
"195635176180278188454220685630925180317",
"149343905028571698896489675590592518881",
"113228339877868088439365118782052718013",
"229830870869054432840053288375151147638",
"187392765435355128435297172747438131701",
"50062830454482620406298128559525981332",
"229484959883607710932890551051089055883",
"313290331419322667152370503501833381416",
"261742625966502905435915291796484398475",
"83166721684958501438542292680715322988",
"40558829371074519779147737020318940416",
"25348444712312944134790409769153026488",
"53051109841936813343275555114446175057",
"200177930655389788861924861566757896867",
"202144674280851333228237832831212929564",
"232876760698924399671107116053169257199",
"150864150449797823664412582978663929493",
"282049759159746553557067589589697946011",
"131608495455840992419296031827613961615",
"240392124568649149945848811194548125877",
"292022962937100339889898641776478869683",
"268517170154511097130957820396147354569",
"300704255287704337444402831842670912107",
"273761061573371873948549311570457936809",
"49074267691867510933480458527632526864",
"171693332646674877205390337429171514802",
"335509684411915389985926068971268824398",
"322309290825148139051909173658894015296",
"48238393614040181466895048209203483588",
"114401482912619994548320910511957553799",
"148125808627510183406075802577452902817",
"62470190960981993036241220790923521849",
"263817870592180464877621817428000760741",
"303018345821218295951902191452368704597",
"322002210996007724086259449746786266687",
"76434713514975885061549233430868912416",
"11781091581557001103086991756380247963",
"115760691390054614493330278260925241477",
"163365333947463192760216260292028193514",
"293396016499312223133217514349264848964",
"285625719327529595948928804186543747947",
"73260166241771144482712614856617644296",
"189881916345464970767444777128067768233",
"147012012272348443092328714534299430807",
"13929977605174970442083823114970640631",
"69611761018237000440630426994925980019",
"275588503807892976474182022677582535796",
"80786251600860782623483401213548251501",
"114271594187577706551306685366122868535",
"142335671002831055205711692960212448550",
"78736115643936558739236076288392920475",
"219336271122197104040924281934277204678",
"148125808627510183406075802577452902817",
"62470190960981993036241220790923521849",
"112537782660296115409262568604892888719",
"32661224401521340617824951733841144936",
"208529629888241783618426828810372070695",
"12400248326821937529641698976921386684",
"214125812052550387668170721204978839380",
"262877785499496427123674232757730985188",
"163365333947463192760216260292028193514",
"240861143365462400150777973514415229465",
"179025519348232037570415219623209968842",
"203468030470689457246321546122275483887",
"15610854356420649896301184838708243590",
"334096666382306377408358691242128199791",
"90722157812978192597821368188599424908",
"143068294329137760775979642707955376502",
"102478633850808813189472015356211100405",
"292185730413756171831478154354978844985",
"293687123093708481506566762257070153367",
"279621357922962264597325595262038493581",
"106321364934840379011500022199332339716",
"207003064318455714099216449224719171663",
"266976008140751638706477471605875803332",
"184370127954544263532774783462752780763",
"5773911874727825347251388690263717113",
"44882877956792162709429509261959657990",
"44824800310398853802536329805759991282",
"79996366474562236966173636482948710120",
"125399052029207239715071300860963611662",
"251694751012175972720052049932179040085",
"13491671498515745338026738439928541013",
"273044645211350846033584871890401335473",
"112378817584887142552248746240658886301",
"264541933684813710677452234457663291181",
"109930294219827859703641210862553526414",
"58792010138673502829860954180384457536",
"6320866944259239931532652828562277501",
"256376913691307458939939981723113095813",
"62842664744374745697027585311824726450",
"37959283970951503244870753755565221592",
"184888343347518555750835875104359161241",
"64706912324380719104460012708957641243",
"259908304279843707628334350437978459134",
"38548958081144215509343811698519694298",
"148125808627510183406075802577452902817",
"62470190960981993036241220790923521849",
"298303357335882703789384309349445614572",
"50505117641136550853644481977297631401",
"339312396477880061610800659766608035530",
"321696132967689012284427981411632622295",
"123637034485235955858322769414572638723",
"262877785499496427123674232757730985188",
"273044645211350846033584871890401335473",
"163365333947463192760216260292028193514",
"75407180318704451699303769443305508093",
"244758974492103166496121170070177083813",
"109370476594929626191047116129114784150",
"267798296318058126163671294458468434223",
"241774128853434093839025675082796275444",
"63635656948519790150239451595708253780",
"305554571075617287762175881403420657956",
"57426904730747792925506724602887439732",
"202884862624409168860318294692742204347",
"276758430994862472890468048793635769503",
"137956073693809944900317947803914591921",
"266976008140751638706477471605875803332",
"184370127954544263532774783462752780763",
"5773911874727825347251388690263717113",
"279340083568858591405565413033322753960",
"68331036247051946537292719278498490485",
"116627393308623656171160535449403052536",
"124388907338238872677946496969676297269",
"231315096944271878737158237780901547188",
"13491671498515745338026738439928541013",
"273044645211350846033584871890401335473",
"112378817584887142552248746240658886301",
"264541933684813710677452234457663291181",
"109930294219827859703641210862553526414",
"38353245494614188996310985016254065571",
"257523827990126643540204705557821429307",
"167425535444480417941533056392652132965",
"255012736112290070874034307346560554334",
"228302480230789995788117767871542837628",
"236647710000482258233823995055323015308",
"281361198142533475760412086475458034552",
"31978270230158816525455248803222911121",
"310677897064296549048387168676168414717",
"148125808627510183406075802577452902817",
"62470190960981993036241220790923521849",
"249294985089080824845349781248741776724",
"327841468724675351013371196271937725689",
"20765567614540427931855681444919974735",
"152408022109187898182275459104596290538",
"209590346660910975098575183654590573354",
"262877785499496427123674232757730985188",
"273044645211350846033584871890401335473",
"163365333947463192760216260292028193514",
"75407180318704451699303769443305508093",
"295618211377493988695765966742427353852"
]
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@e85cc46d0b36cdba50fe8411cc93d55a49ebfccf",
"signature_type": "Line"
},
{
"id": "CVE-2026-19685-d2d74ac5",
"target": {
"file": "src/core/supplicant/nm-supplicant-config.c"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"323687208157524209904935920563021763704",
"90309817099979093807617305020550269454",
"70011673876090580604826679053282008996",
"48311175517205442491212890254281955935",
"59701939453414132280699401764991736910",
"152881955854067329230255742676342168901",
"83329863129463730750333310813988361422",
"326237791107448692578625897338742981162"
]
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@a8e87381a3e70060abd721d9a347f42b2ba68e6e",
"signature_type": "Line"
},
{
"id": "CVE-2026-19685-d48b3960",
"target": {
"function": "nm_supplicant_config_add_setting_wireless_security",
"file": "src/core/supplicant/nm-supplicant-config.c"
},
"deprecated": false,
"digest": {
"function_hash": "223509578368128510091524484197112636679",
"length": 7966.0
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@e85cc46d0b36cdba50fe8411cc93d55a49ebfccf",
"signature_type": "Function"
},
{
"id": "CVE-2026-19685-e1028ace",
"target": {
"function": "build_supplicant_config",
"file": "src/core/supplicant/tests/test-supplicant-config.c"
},
"deprecated": false,
"digest": {
"function_hash": "34835576532670117958442414166428355289",
"length": 766.0
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@e85cc46d0b36cdba50fe8411cc93d55a49ebfccf",
"signature_type": "Function"
},
{
"id": "CVE-2026-19685-e9660d9e",
"target": {
"function": "nm_supplicant_config_add_setting_8021x",
"file": "src/core/supplicant/nm-supplicant-config.c"
},
"deprecated": false,
"digest": {
"function_hash": "212099757239807153342382541427722502091",
"length": 11439.0
},
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/networkmanager/networkmanager@e85cc46d0b36cdba50fe8411cc93d55a49ebfccf",
"signature_type": "Function"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19685.json"
vanir_signatures_modified
"2026-08-30T08:17:19Z"