CVE-2026-25740CWE-250

Privilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS module

Medium · published February 9, 2026

CVSS v4.0
5.8
EPSS
0%
Percentile
7.6
In the wild
Unconfirmed
What it is

captive browser, a dedicated Chrome instance to log into captive portals without messing with DNS settings. In 25.05 and earlier, when programs.captive-browser is enabled, any user of the system can run arbitrary commands with the CAP_NET_RAW capability (binding to privileged ports, spoofing localhost traffic from privileged services...). This vulnerability is fixed in 25.11 and 26.05.

The record
Technical detail
CVSS v4.0
5.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00184 · 7.6th percentile
Weakness
CWE-250 · Execution with Unnecessary Privileges
Published
2026-02-09T20:17Z
EPSS history
Timeline
  • 09 FEB 20:17Z
    Privilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS module
    cvelistv5