This vulnerability exists in NetworkManager's dhclient backend component, where improper neutralization of special elements in MUD URLs can lead to OS command injection. A local attacker with limited privileges can exploit this by providing a crafted MUD URL that triggers script execution, resulting in privilege escalation. The issue requires explicit administrator configuration to use dhclient, so default setups are not vulnerable. The CVSS 3.1 base score is 6.7, indicating medium severity. No vendor advisory indicates an official fix or patch availability at this time.

Successful exploitation allows a local user to escalate privileges on the affected system, potentially gaining higher-level access. Confidentiality, integrity, and availability impacts are rated high by the CVSS vector, but exploitation requires local access and specific configuration, limiting the attack surface.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-10805 for current remediation guidance. Until a fix is available, administrators should review their NetworkManager configurations and avoid enabling dhclient backend unless necessary. No official fix or temporary workaround is currently documented.