CVE-2026-73973
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Vulnerability in Linuxfabrik Monitoring Plugins allows reading arbitrary files via the logfile plugin, which does not confine the path to /var/log. An attacker controlling the monitoring account can read files such as /etc/shadow.
Risk Assessment
Risk of exposing sensitive data, including system passwords, potentially leading to full system compromise.
Recommendation
Update Linuxfabrik Monitoring Plugins to version 7.0.0 or later, which restricts paths to allowed log directories and resolves symlink issues.
Other vulnerabilities in Linuxfabrik Monitoring Plugins
See all- CVE-2026-52817High
Linuxfabrik Monitoring Plugins before version 5.1.0 contains a vulnerability in the sudo policy that allows the nagios or icinga account to execute /usr/bin/apt-get as root without argument restrictions. An attacker controlling that account can use the APT::Update::Pre-Invoke option to execute arbitrary commands with root privileges, leading to full host compromise.
- CVE-2026-67436High
The redfish-* plugins in Linuxfabrik monitoring-plugins up to version 6.0.0 build request URLs by concatenating a base URL with @odata.id links from responses, allowing a malicious or compromised BMC to redirect authenticated Redfish requests and disclose X-Auth-Token or HTTP Basic credentials.
- CVE-2026-67433Medium
A vulnerability in linuxfabrik monitoring-plugins version 6.0.0 allows a local user controlling the plugin account to place a symlink that will be followed by sqlite3.connect() during a root-run log check. The database migration moves a file from /tmp using os.rename().
Original NVD description (English source)
Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 7.0.0, check-plugins/logfile/logfile accepted a free-form --filename path and opened it as root when invoked through the shipped nagios or icinga sudoers allowlist, without confining the resolved path to /var/log. An attacker who controls the monitoring account can select a root-readable file such as /etc/shadow and use --warning-regex . while leaving SUPPRESS_OUTPUT false, causing each nonempty line to be collected in warn_matches and returned through lib.base.oao(). The vulnerable flow passes the expanded scan_path directly to open(), and neither real-path containment nor an allowlist protects the sink. The same fix also confines mysql-logfile and openvpn-client-list paths, allows only documented log roots, and resolves symlinks and parent-directory traversal before checking containment. This issue is fixed in version 7.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS