A local user can trigger a privilege escalation by sending or using a malformed Manufacturer Usage Description (MUD) URL that is processed by NetworkManager’s dhclient backend. The malformed URL causes the backend to execute a script, allowing the attacker to gain root privileges on the host. This flaw is an instance of OS Command Injection (CWE-78).

Red Hat Red Hat Enterprise Linux 6, 7, 8, 9, 10; Red Hat Multicluster Engine for Kubernetes; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat OpenShift Container Platform 4. The default configuration of NetworkManager on these systems does not enable the dhclient backend, so an administrator must have explicitly changed the configuration.

The CVSS score is 6.7, indicating moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, implying there is no publicly known exploit known to be in use. The attack requires a local user who can trigger the MUD URL and must have an environment where NetworkManager is configured to use dhclient; if those conditions are met, the attacker can elevate privileges to root. The likely vector is local, native to the system, and would require local execution of a crafted MUD URL or a similar input.