CVE-2026-105429
8.0HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-78, CWE-116
Impact
A malicious or compromised peer can execute arbitrary commands as any local user invoking ssh on affected client hosts. The attacker must control a peer FQDN or hostname within the NetBird network.
Root cause
The SSH configuration manager writes unescaped peer hostnames into system-wide OpenSSH drop-in config files, allowing directive injection via double quotes.
Affected systems
NetBird 0.60.0 through 0.74.6 on Linux, macOS, Windows, and FreeBSD (Android and iOS are not affected)
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade NetBird clients to version 0.74.7 or later. As an interim mitigation, remove the generated drop-in configuration file (/etc/ssh/ssh_config.d/99-netbird.conf on Unix-like systems or %PROGRAMDATA%\ssh\ssh_config.d\99-netbird.conf on Windows) or disable SSH configuration management in the NetBird client.
$ netbird versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide OpenSSH drop-in file (/etc/ssh/ssh_config.d/99-netbird.conf, or the equivalent under %PROGRAMDATA%\ssh\ssh_config.d on Windows) that embeds each peer FQDN or hostname inside a double-quoted Match host directive without escaping. A peer name containing a double quote breaks out of the quoted context and injects arbitrary SSH configuration directives, including exec commands, which run locally as any user on the host the next time that user runs ssh. Desktop clients on Linux, macOS, Windows and FreeBSD are affected; the Android and iOS apps are not. The issue is fixed in version 0.74.7, which accepts a peer FQDN or hostname only if it is a valid DNS name.