CVE-2026-67435
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability in linuxfabrik-lib before version 6.0.0 allows a redirecting server to intercept credential headers (other than Authorization and Cookie) during URL requests. The lib.url.fetch() function forwards headers on cross-origin redirects.
Risk Assessment
An attacker could intercept sensitive headers like X-Auth-Token, potentially leading to unauthorized access to monitored systems.
Recommendation
Upgrade linuxfabrik-lib to version 6.0.0 or later.
Other vulnerabilities in linuxfabrik-lib
See all- CVE-2026-73974Medium
Vulnerability in linuxfabrik-lib and Linuxfabrik Monitoring Plugins allows reading files via a hidden --test argument that does not confine paths to the test directory. An attacker controlling the nagios or icinga account can disclose root-readable file contents, e.g., via the deb-updates plugin.
- CVE-2026-55426High
Vulnerability in linuxfabrik-lib and Linuxfabrik Monitoring Plugins. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0.
- CVE-2026-53759Low
Vulnerability in linuxfabrik-lib before version 4.2.0. The db_sqlite.py module created SQLite databases at predictable paths in /tmp and followed attacker-created symbolic links. An attacker with a local monitoring account can create a symlink and trigger a sudo-authorized plugin, leading to arbitrary path overwrite, denial of service, or manipulation of an existing database. Fixed in version 4.2.0.
Original NVD description (English source)
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 6.0.0, lib.url.fetch() followed cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie, allowing a malicious redirect-capable server to receive headers such as X-Auth-Token from authenticated monitoring requests. This issue is fixed in version 6.0.0.