NetworkManager Local Privilege Escalation and Credential Theft via CA Path Manipulation

NetworkManager contains an authorization vulnerability, tracked as CVE-2026-19685, stemming from an incomplete fix for CVE-2025-9615. The issue involves the failure to apply 'private_user' restrictions to the '802-1x.ca-path' and 'phase2-ca-path' connection properties. This vulnerability permits an unprivileged local user on systems running affected versions of NetworkManager to modify the CA path within a WPA-Enterprise (802.1X) connection profile. By pointing these paths to an attacker-controlled directory, a local user can successfully bypass server certificate validation. This defect is particularly critical in enterprise environments where 802.1X is the primary mechanism for network authentication, as it enables the capture of user credentials via rogue access point (AP) interception. The issue specifically impacts Red Hat Enterprise Linux 10 and related infrastructure, as identified by Red Hat.

Attack Chain

1. Attacker gains unprivileged access to a Linux system running an affected version of NetworkManager.
2. Attacker inspects existing WPA-Enterprise (802.1X) connection profiles.
3. Attacker uses NetworkManager command-line utilities (e.g., nmcli) to modify the '802-1x.ca-path' or 'phase2-ca-path' properties of a specific connection profile.
4. Attacker directs the modified CA path to a directory under their control containing a malicious, forged CA certificate.
5. Attacker deploys a rogue wireless access point configured to present the credentials required for the target network.
6. Victim system connects to the rogue AP, relying on the attacker-controlled CA path for validation.
7. NetworkManager successfully validates the connection against the attacker's forged certificate due to the bypass.
8. Attacker captures authentication credentials (e.g., EAP-MSCHAPv2 hashes) relayed by the victim during the 802.1X handshake.

Impact

Successful exploitation allows for the interception of sensitive network credentials in enterprise environments. By bypassing certificate validation, an attacker can perform man-in-the-middle attacks on WPA-Enterprise wireless networks. This leads to unauthorized network access and potential lateral movement within the victim's organization. The severity is elevated to 'critical' by some assessments due to the potential for total impact on confidentiality and integrity of network authentication.

Recommendation

• Prioritize updating NetworkManager packages across all systems running Red Hat Enterprise Linux 10 to the version containing the fix for CVE-2026-19685.
• Restrict local access to system configuration files and NetworkManager connection profiles using standard Linux file permissions to prevent unauthorized modification by unprivileged users.
• Monitor system logs for unexpected modifications to network connection profiles via 'nmcli' or direct file editing of '/etc/NetworkManager/system-connections/'.
• Review 802.1X deployment configurations to ensure consistent enforcement of server-side certificate verification in high-security zones.