The vulnerability arises from the use of shell_exec in Linuxfabrik Monitoring Plugins where user input is directly embedded into shell command strings. For example, the restic-check plugin places the --repo argument inside a shell_exec command string, allowing an attacker to inject additional commands separated by pipe characters. This enables local privilege escalation when the plugin is run with elevated privileges, such as via sudo for the nagios user. The fix involves removing the pipe-based command splitting and requiring commands to be passed as argument arrays to shell_exec, which disables shell interpretation and injection. Additional safeguards include escaping positional arguments and building argument lists to prevent option injection. The vulnerability is tracked as CVE-2026-55426 and affects linuxfabrik-lib versions before 5.0.0, with fixes included in linuxfabrik-lib 5.0.0 and Monitoring Plugins releases after v5.2.0.

This vulnerability allows a local attacker with control over the nagios user to escalate privileges to root by injecting arbitrary commands into plugin arguments that are executed with elevated privileges. The impact includes full system compromise due to root access. The CVSS 3.1 vector rates this as AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local attack vector, low attack complexity, required privileges as low (nagios user), no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

A fix is available in linuxfabrik-lib version 5.0.0 and Linuxfabrik Monitoring Plugins releases after v5.2.0. These versions remove the vulnerable pipe-based command splitting and require commands to be passed as argument arrays to shell_exec, eliminating shell injection risks. Users should upgrade to these fixed versions. The vendor advisory does not indicate any alternative mitigations or temporary workarounds. Patch status is confirmed by the vendor advisory.