CVE-2026-67436
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The redfish-* plugins in Linuxfabrik monitoring-plugins up to version 6.0.0 build request URLs by concatenating a base URL with @odata.id links from responses, allowing a malicious or compromised BMC to redirect authenticated Redfish requests and disclose X-Auth-Token or HTTP Basic credentials.
Risk Assessment
An attacker can intercept authentication credentials for infrastructure management, potentially leading to further compromise of monitored systems.
Recommendation
Update the monitoring-plugins to a version newer than 6.0.0 or apply temporary network safeguards.
Other vulnerabilities in Linuxfabrik monitoring-plugins
See all- CVE-2026-73973Medium
Vulnerability in Linuxfabrik Monitoring Plugins allows reading arbitrary files via the logfile plugin, which does not confine the path to /var/log. An attacker controlling the monitoring account can read files such as /etc/shadow.
- CVE-2026-52817High
Linuxfabrik Monitoring Plugins before version 5.1.0 contains a vulnerability in the sudo policy that allows the nagios or icinga account to execute /usr/bin/apt-get as root without argument restrictions. An attacker controlling that account can use the APT::Update::Pre-Invoke option to execute arbitrary commands with root privileges, leading to full host compromise.
- CVE-2026-67433Medium
A vulnerability in linuxfabrik monitoring-plugins version 6.0.0 allows a local user controlling the plugin account to place a symlink that will be followed by sqlite3.connect() during a root-run log check. The database migration moves a file from /tmp using os.rename().
Original NVD description (English source)
Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish-* plugins built request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, allowing a malicious or compromised BMC to redirect authenticated Redfish requests and disclose X-Auth-Token or HTTP Basic credentials.