PT-2026-113639

CVE-2026-105429

Published

2026-10-14

Updated

2026-10-14

Description by

CVSS 4.0

8.9

High

MetricsAV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions NetBird versions 0.60.0 through 0.74.6

Description Improper neutralization of special elements in the SSH configuration manager located in client/ssh/config/manager.go allows a malicious or compromised peer to execute arbitrary commands on other client hosts. The client creates a system-wide OpenSSH drop-in file (such as /etc/ssh/ssh config.d/99-netbird.conf or %PROGRAMDATA%sshssh config.d on Windows) that embeds peer FQDNs or hostnames within a double-quoted Match host directive without proper escaping. A peer name containing a double quote can break the quoted context and inject arbitrary SSH configuration directives, including exec commands, which execute locally as any user on the host when that user runs ssh. This affects desktop clients on Linux, macOS, Windows, and FreeBSD.

Recommendations Update to version 0.74.7.

Exploitability

Fix

Impacts

Researchers

Arjun Basnet

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-116: Improper Encoding or Escaping of Output

Related identifiers