EUVD-2026-61489
GHSA-8w6w-23mq-h8rg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise nagios account
-
DeliveryAccess monitoring host shell
-
ExploitRun sudo apt-get with Pre-Invoke option
-
ExecutionSpawn /bin/sh as root
-
ImpactFull local system compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Argument sanitization
|
| Exploitation Conditions | Exploitation requires two absolute prerequisites: the attacker must already have shell access as the nagios user on the target host, and the Linuxfabrik Monitoring Plugins Debian.sudoers file must be deployed and active (granting nagios NOPASSWD sudo rights to /usr/bin/apt-get without argument restriction). The flaw does not provide any initial access capability - nagios account compromise is a hard prerequisite. Exploitation is further limited to Debian-family systems (Debian, Ubuntu, and compatible distributions) running Linuxfabrik Monitoring Plugins 5.0.0 or earlier where the sudoers asset file has been installed. No special network conditions, service exposure, or additional configuration beyond the deployed sudoers file are required once nagios account access is established. |
| Impact | The CVSS 4.0 base score of 7.0 reflects full local system compromise (VC:H/VI:H/VA:H) substantially offset by a high privilege prerequisite (PR:H) and a local-only attack vector (AV:L). The E:P supplemental metric confirms a proof-of-concept is publicly available, elevating practical exploitability for any actor already holding the nagios account. No EPSS data was provided for independent comparison, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis. The advisory itself characterises the nagios account compromise requirement as 'quite a high barrier,' which aligns with the PR:H signal - this is a post-compromise escalation path, not an initial-access vector. Real-world priority should be driven by whether the Debian.sudoers file is actually deployed and whether the nagios account is exposed to exploitation through Nagios/Icinga web interfaces or adjacent plugin vulnerabilities. For organisations meeting both conditions, the risk is material and patching straightforward. |
| Exploit ScenarioDerived | An attacker who has gained shell access as the nagios user - through exploitation of a Nagios or Icinga web interface vulnerability, stolen credentials, or compromise of another monitoring plugin - runs the single command sudo apt-get update -o APT::Update::Pre-Invoke::='/bin/sh', causing apt-get to invoke /bin/sh as root via the pre-invoke hook mechanism before performing any network operation. The resulting interactive root shell provides full local system control. The exact proof-of-concept command is documented in the vendor advisory GHSA-8w6w-23mq-h8rg. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 18, 2026
Local privilege escalation in Linuxfabrik Monitoring Plugins allows the nagios monitoring user to obtain a root shell on Debian systems by injecting arbitrary arguments into an unrestricted apt-get sudoers rule. Deployments running version 5.0.0 or earlier with the bundled Debian.sudoers file installed are affected; exploitation requires prior compromise of the nagios account. A public proof-of-concept is documented in the vendor advisory, and a confirmed fix is available in version 5.1.0 released 2026-05-30.
Earlier versions of this analysis (1)
Local privilege escalation in Linuxfabrik monitoring-plugins arises from the shipped Debian.sudoers file, which grants the nagios user passwordless sudo to apt-get without constraining arguments (CWE-88 argument injection). Any attacker who already controls the nagios account can run 'sudo apt-get update -o APT::Update::Pre-Invoke::=/bin/sh' to spawn a root shell. Publicly available exploit code exists (documented in the GitHub advisory PoC), but there is no public evidence of active exploitation and no CVSS score was assigned.
RemediationAI
Upgrade Linuxfabrik Monitoring Plugins to version 5.1.0 or later; the fix is confirmed in commit 694b5daeebadc9a51428f3de1acff7b1f737642f and restricts the sudoers apt-get grant to the exact invocation /usr/bin/apt-get update --quiet 2, eliminating the argument injection surface entirely. Full advisory and release details are available at https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-8w6w-23mq-h8rg. If an immediate upgrade is not possible, manually edit the deployed sudoers file (typically in /etc/sudoers.d/) to replace the unrestricted /usr/bin/apt-get entry with /usr/bin/apt-get update --quiet 2; this workaround has no functional side effect on the deb-updates plugin, which calls apt-get with exactly those arguments. Additionally, audit the entire deployed sudoers file for other command grants that omit argument constraints, as the same argument-injection technique may apply to other listed binaries.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Debian.sudoers file distributed with Linuxfabrik Monitoring Plugins (pip package linuxfabrik-lib, CPE pkg:pip/linuxfabrik-lib). The file grants the nagios user passwordless sudo access to /usr/bin/apt-get without restricting which arguments may be passed. CWE-88 (Argument Injection) identifies the root cause: apt-get's -o flag accepts APT runtime configuration options, including Pre-Invoke hooks that execute arbitrary shell commands before the update process. Because the Cmnd_Alias in the sudoers file was defined as the bare binary path /usr/bin/apt-get with no argument constraints, any argument combination is permitted under the grant. The fix - confirmed in commit 694b5dae - narrows the sudoers entry to the exact invocation /usr/bin/apt-get update --quiet 2 that the deb-updates plugin legitimately requires.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Local-only attack (AV:L) requiring an established nagios session (PR:H, AC:L); scope unchanged as root shell remains on the same host (S:U); full C/I/A impact once escalated.
Primary rating from Vendor (https://github.com/Linuxfabrik/monitoring-plugins).
CVSS VectorVendor: https://github.com/Linuxfabrik/monitoring-plugins
Lifecycle Timeline
2DescriptionCVE.org
Summary
In the Debian.sudoers file, apt-get is allowed for the nagios user. The full command including the arguments are not enforced and can therefore be choosen arbitrarily. This allows to easily get a root shell as the nagios user:
PoC
By choosing a particular argument, you can get (as a nagios user) a root shell:
sudo apt-get update -o APT::Update::Pre-Invoke::="/bin/sh"Since the nagious user can use sudo to run apt-get as root, the resulting shell is also running as root.
Impact
The vulnerability is a local privilege escalation, impacting users who use the provided sudoers file. It requires that an attacker already compromised the nagios account (which is quite a high barrier to be honest).
Fix
Since only one place where apt-get is currently used (in deb-updates) was found, it should be enough to allow only the specific arguments used there.
Here an example how the line in the sudoers file could look like:
/usr/lib64/nagios/plugins/strongswan-connections,\
/usr/lib64/nagios/plugins/systemd-unit,\
/usr/bin/apt-get update --quiet 2Executive ViewAI
Linuxfabrik Monitoring Plugins versions 5.0.0 and earlier contain a local privilege escalation that allows compromised monitoring service accounts to gain root access on Debian systems. If the nagios monitoring user is breached, attackers obtain full system control, creating a direct path to compromise production infrastructure and disable or manipulate critical monitoring that organizations rely on for operational continuity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB