NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties, allowing an unprivileged local user to point a private WPA-Enterprise connection profile's CA path to an attacker-controlled directory. This bypasses server certificate validation and enables credential theft via a rogue access point. The vulnerability is an incomplete fix for CVE-2025-9615, as the private_user guard was not applied to these directory properties, unlike sibling FILE-typed certificate/key properties. Exploitation requires an active local user session with the settings.modify.own polkit permission and affects only WPA-Enterprise (802.1X) connections. The issue is not exploitable remotely or via inactive SSH sessions. NetworkManager is the sole affected component; wpa_supplicant and hostapd correctly handle the CA path as provided. No official patch or remediation level is stated yet. Workarounds include avoiding per-user 802.1X profiles with ca-path/phase2-ca-path or setting 802-1x.system-ca-certs=yes to override user-supplied CA paths with system CA certificates.

An unprivileged local user with the settings.modify.own polkit permission can bypass server certificate validation for WPA-Enterprise (802.1X) connections by manipulating CA path directory properties. This allows an attacker to redirect the CA path to a malicious directory, enabling credential theft via a rogue access point. The vulnerability affects confidentiality and integrity by allowing unauthorized reading and modification of sensitive data related to network authentication. It also potentially allows privilege escalation by bypassing protection mechanisms. The flaw is limited to local active sessions and does not affect open or WPA2-Personal networks. There is no known exploitation in the wild at this time.

No official patch or user-facing fix is currently available. Administrators should avoid setting connection.permissions to a specific user on 802.1X profiles that use ca-path or phase2-ca-path, preferring system-wide profiles instead of private per-user ones. Alternatively, setting 802-1x.system-ca-certs=yes forces the use of the compiled system CA path, overriding any user-supplied CA path values. Monitor the Red Hat advisory for updates on an official fix that applies the private_user guard to the ca-path and phase2-ca-path properties in NetworkManager's supplicant config builder.