CVE-2026-19685

NetworkManager attempts to keep an active network connection available at all times. The point of NetworkManager is to make networking configuration and setup as painless and automatic as possible. If using DHCP, NetworkManager is intended to replace default routes, obtain IP addresses from a DHCP server, and change name servers whenever it sees fit.

Security Fix(es):

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.(CVE-2026-19685)

NetworkManager attempts to keep an active network connection available at all times. The point of NetworkManager is to make networking configuration and setup as painless and automatic as possible. If using DHCP, NetworkManager is intended to replace default routes, obtain IP addresses from a DHCP server, and change name servers whenever it sees fit.

Security Fix(es):

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.(CVE-2026-19685)

NetworkManager attempts to keep an active network connection available at all times. The point of NetworkManager is to make networking configuration and setup as painless and automatic as possible. If using DHCP, NetworkManager is intended to replace default routes, obtain IP addresses from a DHCP server, and change name servers whenever it sees fit.

Security Fix(es):

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.(CVE-2026-19685)

NetworkManager attempts to keep an active network connection available at all times. The point of NetworkManager is to make networking configuration and setup as painless and automatic as possible. If using DHCP, NetworkManager is intended to replace default routes, obtain IP addresses from a DHCP server, and change name servers whenever it sees fit.

Security Fix(es):

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.(CVE-2026-19685)

NetworkManager attempts to keep an active network connection available at all times. The point of NetworkManager is to make networking configuration and setup as painless and automatic as possible. If using DHCP, NetworkManager is intended to replace default routes, obtain IP addresses from a DHCP server, and change name servers whenever it sees fit.

Security Fix(es):

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.(CVE-2026-19685)

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.

These are all security issues fixed in the NetworkManager-1.56.1-4.1 package on the GA media of openSUSE Tumbleweed.

This update for NetworkManager fixes the following issues:

• CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).
• CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass (bsc#1276764).

This update for NetworkManager fixes the following issues:

• CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).
• CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass (bsc#1276764).

This update for NetworkManager fixes the following issues:

• CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).
• CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass (bsc#1276764).

This update for NetworkManager fixes the following issues:

• CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).
• CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass (bsc#1276764).

This update for NetworkManager fixes the following issues:

• CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).
• CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass (bsc#1276764).

This update for NetworkManager fixes the following issues:

• CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).
• CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass (bsc#1276764).

This update for NetworkManager fixes the following issues:

• CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).
• CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass (bsc#1276764).

Changes for NetworkManager:

• Add config-server subpackage (bsc#1224868).

This update for NetworkManager fixes the following issues:

• CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).
• CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass (bsc#1276764).

This update for NetworkManager fixes the following issues:

• CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).
• CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass (bsc#1276764).

This update for NetworkManager fixes the following issues:

• CVE-2026-10805: Local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).
• CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass (bsc#1276764).

This update for NetworkManager fixes the following issues:

• CVE-2026-10805: Local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).
• CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass (bsc#1276764).

It was discovered that NetworkManager did not properly restrict the ca-path and phase2-ca-path certificate authority settings for private (single-user) 802.1X network connections. An attacker could use this issue to point their own private 802.1X connection profile at a directory under their control, causing NetworkManager to trust an attacker-chosen certificate authority and potentially exposing network credentials via a rogue authentication server.