Security update for NetworkManager

This vulnerability (CVE-2026-10805) affects NetworkManager on Red Hat Enterprise Linux 9, specifically in the dhclient backend when processing malformed MUD URLs. It allows a local user to escalate privileges by triggering a script via a crafted MUD URL, but only if NetworkManager is configured to use dhclient, which is not the default. The flaw is due to improper neutralization of special elements used in an OS command, classified under CWE-78 (OS Command Injection). Red Hat has issued a security advisory and update to fix this issue.

Successful exploitation allows a local user to escalate privileges on affected systems, potentially gaining higher-level access. The vulnerability does not affect default NetworkManager configurations and requires specific administrator configuration to be exploitable. The CVSS v3.1 base score is 6.7 (medium severity), indicating a significant but not critical risk.

Red Hat has released an official security update that addresses this vulnerability. Users should apply the NetworkManager update provided in Red Hat Advisory RHSA-2026:58572. Since the issue requires explicit configuration of NetworkManager to use dhclient, systems using default configurations are not affected. Refer to Red Hat's official guidance at https://access.redhat.com/articles/11258 for update instructions.