Junglewise Threat Intelligence

CVE-2025-9615: NetworkManager improper file access via root daemon privileges

CVE-2025-9615 · Severity: low · CVSS 3.3 · Published 2026-01-26

Technologies: Red Hat Enterprise Linux. Vendors: Red Hat.

Executive brief

NetworkManager, a standard service for managing network connections on Linux systems, contains a flaw that allows a standard user to access files belonging to other users. By pointing a network configuration to another user's security certificates, an attacker can bypass normal file permissions because the NetworkManager service runs with high-level system privileges. This could allow an unauthorized user to connect to protected Wi-Fi or VPN networks using someone else's credentials.

Technical details

An improper preservation of permissions (CWE-281) flaw in NetworkManager allows a local non-privileged user to specify file paths for certificates or private keys belonging to other users when creating network connections. Because the NetworkManager daemon executes with root privileges, it bypasses standard filesystem DAC (Discretionary Access Control) checks when reading these files to initiate VPN or 802.1X connections. The vulnerability is also present when the 'modify_system' build option is enabled, allowing users with physical access to create system-wide connections using unauthorized files. Fixes include requiring administrative authentication for system-wide changes and implementing a mechanism to copy sensitive files using the identity of the calling user to ensure proper permission enforcement.

Affected products

  • NetworkManager Project NetworkManager versions prior to 1.56.0
  • Red Hat Enterprise Linux 10

Timeline

  • 2025-08-28: other: Vulnerability reported to Red Hat Bugzilla
  • 2025-12-12: other: Upstream merge requests submitted to fix the issue
  • 2026-01-26: disclosed: CVE published
  • 2026-05-19: patched: Red Hat released security updates (RHSA-2026:18142)

References