CVE-2026-19685: Incorrect Authorization in Red Hat Red Hat Enterprise Linux 10

CVE-2026-19685 affects NetworkManager on Red Hat Enterprise Linux 10 by failing to apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user with the settings.modify.own polkit permission to redirect a private WPA-Enterprise connection profile's CA path to an attacker-controlled directory. This bypasses server certificate validation, enabling credential theft through a rogue access point. The issue is limited to WPA-Enterprise connections and requires an active local user session; remote or inactive sessions cannot exploit this flaw. The vulnerability does not affect wpa_supplicant or hostapd, which correctly handle CA paths. An upstream fix was made in NetworkManager 1.58.1 and later development snapshots, rejecting 802-1x.ca-path and phase2-ca-path on private connections and requiring use of ca-cert or system-ca-certs instead.

An unprivileged local user with the settings.modify.own polkit permission can bypass server certificate validation for WPA-Enterprise connections by manipulating CA path properties. This enables credential theft via a rogue access point, compromising confidentiality and integrity of enterprise authentication sessions. The vulnerability does not allow remote exploitation and requires an active local user session. Open and WPA2-Personal networks are not affected. The impact is rated high due to potential credential theft and session integrity compromise.

A fix is available upstream in NetworkManager version 1.58.1 and later development snapshots. Until the fixed package is installed, administrators should use system-wide 802.1X profiles instead of per-user private profiles or set 802-1x.system-ca-certs=yes to override any user-supplied ca-path with the compiled system CA path. These mitigations prevent unprivileged users from bypassing server certificate validation. Refer to the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-19685 for detailed guidance and to obtain patched packages when released.