Threat database

CVE-2026-73974 is a path traversal vulnerability in linuxfabrik monitoring-plugins prior to version 7.0.0 and linuxfabrik-lib prior to 6.1.0. The issue arises because the test helper function lib.lftest.test() improperly handles filesystem paths from a hidden --test argument, allowing unauthorized file reads without path confinement. This vulnerability enables an attacker with sudo-authorized plugin access to read arbitrary root-readable files. The flaw affects multiple plugins that expose file content or existence checks. The vulnerability is fixed by confining fixture reads to a safe directory and routing bypasses through the helper in the fixed versions.

Linuxfabrik monitoring-plugins prior to version 7.0.0 contain a path traversal vulnerability in the logfile check plugin. The plugin accepts a free-form --filename argument and opens the specified file as root without restricting the path to /var/log. This allows an attacker with control over the monitoring account to read arbitrary root-readable files such as /etc/shadow. The issue is fixed in version 7.0.0 by confining paths to documented log roots and resolving symlinks and parent-directory traversal before access.

CVE-2026-67436 is a high-severity vulnerability in Linuxfabrik monitoring-plugins version 6.0.0 and earlier. The redfish-* plugins construct request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links. This improper input validation allows a malicious or compromised Baseboard Management Controller (BMC) to redirect authenticated Redfish requests, potentially exposing X-Auth-Token or HTTP Basic credentials.

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 6.0.0, lib.url.fetch() followed cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie, allowing a malicious redirect-capable server to receive headers such as X-Auth-Token from authenticated monitoring requests. This issue is fixed in version 6.0.0.

CVE-2026-67433 is a medium severity vulnerability in Linuxfabrik monitoring-plugins version 6.0.0. It involves improper link resolution before file access, where a local user controlling the plugin account can create a symbolic link in a predictable /tmp path. This symlink is followed by sqlite3.connect() during a root-run check, potentially leading to unauthorized file access or modification.

CVE-2026-53759 is an insecure temporary file vulnerability in linuxfabrik monitoring-plugins prior to version 4.2.0. The vulnerability arises because the db_sqlite.py module creates SQLite database files at predictable paths in the shared /tmp directory and follows attacker-created symbolic links. A local attacker with monitoring account access can exploit this to cause a root process to overwrite arbitrary files, cause denial of service, or manipulate SQLite databases. The issue is fixed in version 4.2.0 by moving plugin caches to a secured per-user directory.