CVE-2026-67433
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
A vulnerability in linuxfabrik monitoring-plugins version 6.0.0 allows a local user controlling the plugin account to place a symlink that will be followed by sqlite3.connect() during a root-run log check. The database migration moves a file from /tmp using os.rename().
Risk Assessment
A local attacker could access files with root privileges, potentially leading to privilege escalation or data corruption.
Recommendation
Upgrade linuxfabrik monitoring-plugins to a version newer than 6.0.0 that includes a fix.
Other vulnerabilities in linuxfabrik monitoring-plugins
See all- CVE-2026-73973Medium
Vulnerability in Linuxfabrik Monitoring Plugins allows reading arbitrary files via the logfile plugin, which does not confine the path to /var/log. An attacker controlling the monitoring account can read files such as /etc/shadow.
- CVE-2026-52817High
Linuxfabrik Monitoring Plugins before version 5.1.0 contains a vulnerability in the sudo policy that allows the nagios or icinga account to execute /usr/bin/apt-get as root without argument restrictions. An attacker controlling that account can use the APT::Update::Pre-Invoke option to execute arbitrary commands with root privileges, leading to full host compromise.
- CVE-2026-67436High
The redfish-* plugins in Linuxfabrik monitoring-plugins up to version 6.0.0 build request URLs by concatenating a base URL with @odata.id links from responses, allowing a malicious or compromised BMC to redirect authenticated Redfish requests and disclose X-Auth-Token or HTTP Basic credentials.
Original NVD description (English source)
Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename() and allowed a local user controlling the plugin account to place a symlink that would be followed by sqlite3.connect() during a root-run check.