The vulnerability CVE-2026-91840 in NetworkManager-vpnc involves improper neutralization of CRLF sequences (CRLF Injection). A local unprivileged attacker can inject a newline character into the VPN username field, which manipulates the vpnc configuration file. This manipulation allows execution of arbitrary code with root privileges upon activation of the malicious VPN connection. The CVSS v3.1 score is 7.8, indicating high severity with local attack vector, low attack complexity, and no user interaction required. Red Hat's advisory states that no currently supported Red Hat products are affected. The vulnerability is documented with CWE-93 (Improper Neutralization of CRLF Sequences).

A local unprivileged user can escalate privileges to root by exploiting the newline injection in the VPN username field, leading to arbitrary code execution with root privileges when the VPN connection is activated. This can compromise system integrity and confidentiality.

Red Hat states that no currently supported Red Hat products are affected by this vulnerability. If vpnc VPN connections are not required, removing the NetworkManager-vpnc package will eliminate the vulnerability. This can be done by running as root: `dnf remove NetworkManager-vpnc`. Removing this package may impact functionality if vpnc VPNs are actively used. Patch status is not explicitly stated; check vendor advisories for updates.