CVE-2026-10805
Medium
Description
A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.
SeverityMedium
CVSS6.7
Exploit probability—
Product
Enterprise Linux 8
PublishedJun 4, 2026
First seenJun 4, 2026
Weakness typeCWE-78OS command injection
How to fix
Vendor advisories
- access.redhat.com/errata/RHSA-2026:58555
- access.redhat.com/errata/RHSA-2026:58572
- access.redhat.com/errata/RHSA-2026:61239
- access.redhat.com/errata/RHSA-2026:61243
- access.redhat.com/errata/RHSA-2026:61244
- access.redhat.com/errata/RHSA-2026:61341
- access.redhat.com/errata/RHSA-2026:61572
- access.redhat.com/errata/RHSA-2026:61580
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| enterprise_linux 8 | No range specified | — |
| rhel_aus 8.4 | No range specified | — |
| rhel_aus 8.6 | No range specified | — |
| rhel_e4s 8.8 | No range specified | — |
| enterprise_linux 9 | No range specified | — |
| rhel_e4s 9.2 | No range specified | — |
| rhel_e4s 9.4 | No range specified | — |
| rhel_eus 9.6 | No range specified | — |
| Red Hat Multicluster Engine for Kubernetes | No range specified | — |
| Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack | No range specified | — |
| Red Hat Red Hat OpenShift Container Platform 4 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.