CVE-2026-19685

Name of the Vulnerable Software and Affected Versions NetworkManager (affected versions not specified)

Description NetworkManager failed to apply the private user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This allows an unprivileged local user to direct a private WPA-Enterprise (802.1X) connection profile's CA path to a directory controlled by an attacker. This bypasses server certificate validation, which can lead to credential theft through a rogue access point.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.