Loading story…
NetBird released v0.76.0 to fix a high-severity local privilege escalation flaw in its client daemon, tracked as GHSA-qcpp-8vwj-hhwr and rated CVSS 8.8. The vulnerability affected all client versions from v0.5.0 through v0.75.1 on Linux, macOS, FreeBSD, and Windows because the daemon’s local gRPC control interface accepted privileged commands from any local process without authentication. On Unix-like systems, the daemon exposed a world-readable and world-writable Unix socket; on Windows, it listened on an unauthenticated loopback TCP port at 127.0.0.1:41731. NetBird said the issue was not remotely exploitable, did not affect its management server, signal server, relays, or NetBird Cloud, and that it has no evidence of in-the-wild exploitation.
A local attacker could read configuration, change security-sensitive settings, disconnect the VPN, deregister a peer, and re-register the device to an attacker-controlled NetBird account; in some deployments, the flaw could also be chained with NetBird SSH to obtain a root shell. The fix, merged through pull request #6967, adds OS-level caller identity verification using kernel-derived local credentials and restricts dangerous operations such as changing the management URL, deregistering peers, and weakening SSH protections to privileged users only. NetBird said there is no safe workaround that preserves the exposed socket, making an upgrade to v0.76.0 the required remediation for affected clients.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
NetBird released version 0.76.0 as the remediation for the local privilege escalation vulnerability affecting client versions 0.5.0 through 0.75.1. The fix added OS-level caller identity checks and restricted dangerous operations such as enabling SSH root login, changing the management URL, and deregistering peers to privileged users only.
NetBird merged pull request #6967 into main, integrating code to derive caller identity from the operating system and enforce privilege checks around sensitive daemon operations. The merged change also included the Windows move away from the unauthenticated loopback TCP listener toward named pipes.
NetBird said the flaw had existed since version 0.5.0, when the client architecture exposed a local gRPC daemon interface that did not authenticate local callers. This established the start of the affected version range later identified as 0.5.0 through 0.75.1.
NetBird publicly disclosed the high-severity local privilege escalation issue in advisory GHSA-qcpp-8vwj-hhwr, describing how any local process could issue privileged daemon RPCs without authentication on Linux, macOS, FreeBSD, and Windows. NetBird stated the issue was not remotely exploitable, did not affect NetBird Cloud or server-side components, and that it had no evidence of exploitation in the wild.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
netbird.io
Open sourcenetbird.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A public disclosure on the `oss-sec` mailing list reported a **stack buffer overflow** in **BIRD/BIRD2** tied to **BGP `AS_PATH` mask matching**, with a CVE still pending and no confirmed fixed release. Researcher comments in the thread said **BIRD 2.16.2** was reproduced as vulnerable, while other **BIRD 2.x** versions may also be affected if they use the same implementation. The discussion also highlighted conflicting views on remediation status: the reporter said maintainers indicated they did not currently plan to fix the issue, while other participants challenged whether the claim that no fix existed had been sufficiently validated against newer versions or unpublished changes. Separately, **GNU FreeIPMI 1.6.18** was released with security fixes for **exploitable buffer overflows** in OEM-specific `ipmi-oem` functionality. The project said the affected commands were `ipmi-oem dell get-active-directory-config` and `ipmi-oem fujitsu get-sel-entry-long-text`; the release also added an `altbridging` workaround in `ipmi-sensors`. An `oss-sec` post noted that no new CVE appeared to have been assigned for these FreeIPMI flaws at publication time and clarified that **`CVE-2026-33554`** referred to different subcommands fixed earlier in **FreeIPMI 1.6.17**.
Jun 29, 2026
A high-severity flaw in **NATS Server** tracked as `CVE-2026-58253` allows unauthenticated peers to bypass authentication on inter-server **route** and **leafnode** listeners when the `no_auth_user` option is enabled. The bug stems from a parser fast path that was meant for ordinary client connections but was incorrectly applied to non-client connection types, allowing an attacker to skip the required `CONNECT` authentication step and inherit the privileges of that server-to-server connection. The issue is rated **CVSS 8.8** and mapped to **CWE-287 Improper Authentication**. Maintainers fixed the problem by restricting `no_auth_user` behavior to **client connections only** and enforcing that route, leafnode, and some gateway connections must begin with `CONNECT` before other protocol messages are accepted. Associated tests show that non-client peers sending `PING` first are now rejected, direct route-protocol message injection such as `RMSG` without `CONNECT` is blocked, and normal client behavior remains unchanged when `no_auth_user` is configured. The vulnerability affects releases before **2.14.0**, **2.12.7**, and **2.11.16**, which contain the fix.
Jul 9, 2026
GNU InetUtils disclosed **CVE-2026-24061**, a high-severity authentication bypass in `telnetd` that can let a remote client obtain **root** access without valid credentials. The bug affects versions **1.9.3 through 2.7** and stems from `telnetd` passing a client-controlled `USER` environment variable to `/usr/bin/login` without sanitization; a crafted value such as `-f root` can cause `login(1)` to skip normal authentication. The vulnerable code path was traced to a 2015 commit later shipped in the 1.9.3 release, and maintainers published patches while advising organizations not to run `telnetd`, to restrict access to trusted clients, and to upgrade to a fixed release. Public attention quickly expanded beyond the advisory as security researchers and developers published multiple **proof-of-concept exploits, scanners, Nuclei templates, test harnesses, and detection content** on GitHub and in vendor repositories. Those references describe tooling for discovery and exploitation of the `NEW_ENVIRON`/`USER` injection path, including lab environments and root-shell demonstrations, increasing the likelihood of opportunistic targeting against exposed Telnet services. The combination of a remotely reachable root bypass and rapidly available offensive tooling makes internet-facing or internally exposed GNU InetUtils `telnetd` instances an urgent remediation priority.
Jun 29, 2026