What this actually is.
Technical background, root cause, and affected surface.
The NetBird client writes a system-wide OpenSSH drop-in (/etc/ssh/ssh_config.d/99-netbird.conf) that embeds each peer FQDN/hostname inside a double-quoted Match host directive without escaping. A peer whose name contains a double quote breaks out of the quoted context and injects arbitrary SSH config directives, including exec commands, which run locally for every user on the host the next time they invoke ssh.
- Vendor
- NetBird
- Product
- NetBird v0.74.3
- Severity
- High
- CVSS Score
- 8.5
- Status
- Fixed
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-116: Improper Encoding or Escaping of Output
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
Peer FQDN: evil" exec "id > /tmp/pwn" # renders as: Match host "evil" exec "id > /tmp/pwn" #" exec "netbird auth ..." ; running ssh on the victim host writes uid output to /tmp/pwn (Go PoC TestH28_SSHConfigInjection).
The bug, and the fix.
client/ssh/config/manager.go:193: fmt.Fprintf(w, `Match host "%s" exec "netbird auth ..."`+"\n", peerFQDN) // peerFQDN not escaped
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Local command execution as any user on the victim host who runs ssh, triggered by a malicious or compromised peer name in the network map; system-wide config affects all users.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to NetBird 0.74.7 or later (PR #6805). buildHostPatterns now admits a peer FQDN/hostname only if it is a plain DNS name (domain.IsValidDomainNoWildcard), rejecting quotes, whitespace, newlines, commas and pattern metacharacters.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Reported to NetBird via GitHub Security Advisory
Vendor accepted
Fix released in 0.74.7 (PR #6805)
Advisory published (GHSA-xmg2-v32j-x2hf)
CVE-2026-105429 assigned
Disclosed 0 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.