This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-91841 →

DEBIAN-CVE-2026-91841

A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newl...

Original description

The description as published by the source.

A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege escalation.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 network-manager-vpnc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 network-manager-vpnc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org