A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can… (CVE-2026-72694)
A local privilege escalation vulnerability exists in the Multi Router Traffic Grapher (MRTG) daemon when started as root and then dropping privileges. An attacker with local access can exploit a symbolic link (symlink) following flaw by manipulating the PID file path, causing the root process to change ownership of arbitrary files to the daemon user. This vulnerability is tracked as CVE-2026-72694 and has a CVSS score of 7.1 (high severity). Red Hat has released security updates addressing this issue for Red Hat Enterprise Linux versions 9 and 10.
AI Analysis
Technical Summary
CVE-2026-72694 is a local privilege escalation vulnerability in MRTG caused by a symlink-following flaw in the PID file handling. When the MRTG daemon is started as root and drops privileges, a local attacker can pre-place or influence a symlink in the PID file path. This causes the root process to perform a chown operation on an arbitrary existing file, changing its ownership to the MRTG daemon user. This can allow unauthorized access or modification of sensitive files. The vulnerability is identified as CWE-59 (Improper Link Resolution Before File Access). Red Hat has issued security advisories and patches for affected Red Hat Enterprise Linux 9 and 10 variants to fix this issue.
Potential Impact
Successful exploitation allows a local, low-privileged attacker to escalate privileges by causing MRTG running as root to change ownership of arbitrary files. This can lead to unauthorized access or modification of sensitive files, potentially compromising system security. The CVSS 3.1 base score is 7.1, reflecting high impact on confidentiality and integrity with no impact on availability.
Mitigation Recommendations
Red Hat has released official security updates for MRTG that address this vulnerability. Users of Red Hat Enterprise Linux 9 and 10 should apply the MRTG package updates provided in advisories RHSA-2026:57596 and RHSA-2026:57600. Details and update instructions are available at https://access.redhat.com/articles/11258. Applying these updates fully mitigates the vulnerability. No additional mitigation steps are required beyond applying the official patches.
A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can… (CVE-2026-72694)
Description
A local privilege escalation vulnerability exists in the Multi Router Traffic Grapher (MRTG) daemon when started as root and then dropping privileges. An attacker with local access can exploit a symbolic link (symlink) following flaw by manipulating the PID file path, causing the root process to change ownership of arbitrary files to the daemon user. This vulnerability is tracked as CVE-2026-72694 and has a CVSS score of 7.1 (high severity). Red Hat has released security updates addressing this issue for Red Hat Enterprise Linux versions 9 and 10.
CVSS v3.1
Score 7.1high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-72694 is a local privilege escalation vulnerability in MRTG caused by a symlink-following flaw in the PID file handling. When the MRTG daemon is started as root and drops privileges, a local attacker can pre-place or influence a symlink in the PID file path. This causes the root process to perform a chown operation on an arbitrary existing file, changing its ownership to the MRTG daemon user. This can allow unauthorized access or modification of sensitive files. The vulnerability is identified as CWE-59 (Improper Link Resolution Before File Access). Red Hat has issued security advisories and patches for affected Red Hat Enterprise Linux 9 and 10 variants to fix this issue.
Potential Impact
Successful exploitation allows a local, low-privileged attacker to escalate privileges by causing MRTG running as root to change ownership of arbitrary files. This can lead to unauthorized access or modification of sensitive files, potentially compromising system security. The CVSS 3.1 base score is 7.1, reflecting high impact on confidentiality and integrity with no impact on availability.
Mitigation Recommendations
Red Hat has released official security updates for MRTG that address this vulnerability. Users of Red Hat Enterprise Linux 9 and 10 should apply the MRTG package updates provided in advisories RHSA-2026:57596 and RHSA-2026:57600. Details and update instructions are available at https://access.redhat.com/articles/11258. Applying these updates fully mitigates the vulnerability. No additional mitigation steps are required beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-pqrp-p4c6-2q4g
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-72694"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Patch Information
Threat ID: 6aa15f19acd9273b49615a1d
Added to database: 09/09/2026, 13:28:57 UTC
Last enriched: 09/09/2026, 13:34:06 UTC
Last updated: 09/09/2026, 14:51:59 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.