# CVE-2026-91838: NetworkManager-sstp shell injection in VPN profile fields

Source: https://junglewise.ai/threats/cve-2026-91838-a-flaw-was-found-in-networkmanager-sstp-the-sstp-vpn-plugin-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91838 · Severity: high · CVSS 7.8 · Published 2026-09-25

NetworkManager-sstp is a VPN plugin that allows Linux systems to connect to corporate SSTP VPN networks. A local user can inject shell commands into VPN connection settings (such as certificate paths or proxy configuration), which are then executed with root privileges when the VPN connection is activated, enabling privilege escalation and arbitrary command execution.

Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome).

## Quick answers

**Is CVE-2026-91838 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91838 being exploited in the wild.

**How severe is CVE-2026-91838?** High severity, with a CVSS score of 7.8, published 25 September 2026.

**Which products and versions are affected?** GNOME NetworkManager-sstp.

**Is there a fix for CVE-2026-91838?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-91838 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-91838?** Check whether you run Gnome NetworkManager-sstp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CWE-78 OS command injection in the SSTP VPN plugin allows local unprivileged users to embed unescaped shell metacharacters into VPN connection profile fields. These fields are passed unsanitized to the pppd daemon which runs with root privileges, permitting command execution. Attack requires local access and user activation of a malicious VPN profile.

## Affected products

- GNOME NetworkManager-sstp

## Timeline

- 2026-09-25: disclosed

## References

- [https://gitlab.gnome.org/GNOME/network-manager-sstp](https://gitlab.gnome.org/GNOME/network-manager-sstp)
- [https://access.redhat.com/security/cve/CVE-2026-91838](https://access.redhat.com/security/cve/CVE-2026-91838)