DEBIAN-CVE-2026-10805

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-10805
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-10805.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-10805
Upstream
  • CVE-2026-10805
Published
2026-06-04T06:16:21Z
Modified
2026-09-18T08:47:33Z
Severity
  • 6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.

References

Affected packages

Debian:12 / network-manager

Package

Name
network-manager
Purl
pkg:deb/debian/network-manager?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.42.4-1
1.42.4-1+deb12u1
1.42.6-1
1.42.6-2
1.42.8-1
1.44.0-1
1.44.2-1
1.44.2-2
1.44.2-3
1.44.2-4
1.44.2-5
1.44.2-6
1.44.2-7
1.45.90-1
1.45.91-1
1.46.0-1
1.46.0-2
1.47.90-1
1.47.90-2
1.47.91-1
1.48.0-1
1.48.2-1
1.48.4-1
1.48.6-1
1.48.8-1
1.48.10-1
1.49.90-1
1.49.90-2
1.49.91-1
1.50.0-1
1.50.1-1
1.50.2-1
1.50.3-1
1.51.90-1
1.52.0-1
1.52.0-2
1.52.0-3
1.52.0-4
1.52.0-5
1.52.0-6
1.52.1-1
1.54.0-1
1.54.0-2
1.54.0-3
1.54.0-4
1.54.1-1
1.54.2-1
1.54.2-2
1.54.2-3
1.54.3-1
1.54.3-2
1.56.0-1
1.56.0-2
1.56.0-3
1.56.0-4
1.56.0-5
1.56.0-6
1.56.0-7
1.56.1-1
1.58~rc1-1
1.58.0-1
1.58.0-2
1.58.0-3
1.58.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-10805.json"

Debian:13 / network-manager

Package

Name
network-manager
Purl
pkg:deb/debian/network-manager?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.52.1-1
1.54.0-1
1.54.0-2
1.54.0-3
1.54.0-4
1.54.1-1
1.54.2-1
1.54.2-2
1.54.2-3
1.54.3-1
1.54.3-2
1.56.0-1
1.56.0-2
1.56.0-3
1.56.0-4
1.56.0-5
1.56.0-6
1.56.0-7
1.56.1-1
1.58~rc1-1
1.58.0-1
1.58.0-2
1.58.0-3
1.58.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-10805.json"

Debian:14 / network-manager

Package

Name
network-manager
Purl
pkg:deb/debian/network-manager?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.58.0-2

Affected versions

1.*
1.52.1-1
1.54.0-1
1.54.0-2
1.54.0-3
1.54.0-4
1.54.1-1
1.54.2-1
1.54.2-2
1.54.2-3
1.54.3-1
1.54.3-2
1.56.0-1
1.56.0-2
1.56.0-3
1.56.0-4
1.56.0-5
1.56.0-6
1.56.0-7
1.56.1-1
1.58~rc1-1
1.58.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-10805.json"