EUVD-2026-61493
GHSA-798h-hpph-m24j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconGain nagios user access
-
DeliveryIdentify sudo-enabled Linuxfabrik plugin
-
ExploitCraft --repo with |command| payload
-
InstallInvoke plugin via sudo
-
C2shell_exec splits on pipe
-
ExecuteInjected command runs as root
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local control of the nagios (or equivalent monitoring) user account and requires that a vulnerable plugin - the restic-check plugin is the demonstrated case - is invocable through the sudoers file so its command runs as root. The injection works only for plugins that place user-controlled input (such as the --repo argument) into a command string passed to lib.shell.shell_exec() in linuxfabrik-lib before 5.0.0. Limiting factors: the CVSS vector confirms authenticated local access is needed (PR:L, AV:L), there is no remote or unauthenticated path, and root escalation specifically depends on the non-default but common practice of granting the plugins passwordless sudo; without that sudoers entry the attacker can only run commands at their existing nagios privilege level. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) is internally consistent and matches the description: local access, low complexity, low privileges (the nagios user), no user interaction, and full compromise of confidentiality, integrity, and availability once escalation to root occurs. The real-world priority is bounded by the local attack vector and the precondition that the attacker already controls the nagios account and that vulnerable plugins are entries in sudoers - so this is a privilege-escalation stepping stone rather than a remote entry point. Publicly available exploit code exists (PoC in the advisory), which raises practical exploitability, but the absence of KEV listing and any EPSS figure means there is no evidence of widespread active exploitation; risk is highest in environments where nagios plugins are granted passwordless sudo. No signals conflict here - the vector and narrative both clearly describe local privilege escalation. |
| Exploit ScenarioDerived | An attacker who has gained code execution as the nagios monitoring user finds that the restic-check plugin is permitted via sudo. They invoke 'sudo /usr/lib64/nagios/plugins/restic-check --repo "|touch /root/nagios-was-here|"', and the injected command runs as root, as shown in the vendor's PoC. By substituting a reverse shell or a command that adds an SSH key, they escalate from the nagios account to full root control of the host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 06, 2026
Local privilege escalation in Linuxfabrik Monitoring Plugins (and the underlying linuxfabrik-lib Python library) lets an attacker who already controls the low-privileged nagios account execute arbitrary OS commands, typically as root. The flaw stems from the library's shell_exec() helper splitting assembled command strings on the pipe (|) character, so user-controlled plugin arguments such as restic-check's --repo can inject additional commands. Publicly available exploit code exists (a PoC is included in the vendor advisory), but the issue is not listed in CISA KEV and no EPSS score was provided.
RemediationAI
Vendor-released patch: upgrade linuxfabrik-lib to 5.0.0 or later, where shell_exec() requires an argv list and always runs with shell=False, the | split logic and shell= parameter are removed, safe_cli_value() guards positional arguments against option injection, and lib.ssh builds argument lists as well. Correspondingly, update the Linuxfabrik Monitoring Plugins to a release after v5.2.0 (the argv-list conversion landed in commit 23bb570f4). As a compensating control until patched, remove or tightly scope any Linuxfabrik plugin entries in the sudoers file so the nagios user cannot invoke them as root - trade-off: checks that legitimately need elevated privileges (e.g., restic-check reading a protected repo) will stop working - and audit plugins for user-controlled arguments reaching shell_exec(). Refer to advisory GHSA-798h-hpph-m24j (https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-798h-hpph-m24j) for the authoritative fix guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is linuxfabrik-lib (PyPI package linuxfabrik-lib, pkg:pip/linuxfabrik-lib), a shared Python library used by the Linuxfabrik Monitoring Plugins suite for Nagios/Icinga-style checks. Its lib.shell.shell_exec() historically built a single shell command string and ran it via a shell, splitting the string on | to chain sub-commands. Because plugins interpolate user-supplied arguments directly into that string before execution, this is a classic CWE-78 (OS Command Injection) issue: the shell metacharacter | is interpreted rather than treated as literal data, letting an embedded command run as its own process. The restic-check plugin is the demonstrated example, where --repo=|touch /root/nagios-was-here| assembles to 'restic --json --repo=|touch /root/nagios-was-here| --password-file= check' and the pipe-delimited segment executes independently.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attacker must already control the local nagios account (AV:L, PR:L) and injection is trivially reliable (AC:L); escalation to root yields full C/I/A impact.
Primary rating from Vendor (https://github.com/Linuxfabrik/monitoring-plugins).
CVSS VectorVendor: https://github.com/Linuxfabrik/monitoring-plugins
DescriptionCVE.org
Summary
When a check plugin places user provided input inside a command which is passed to shell_exec, an attacker can abuse this to run arbitrary commands. This is mainly dangerous for plugins which are listed in the sudoers file, because this allows an attacker controlling the nagios user to get root privileges.
Details
An example for this is the restic-check plugin, where the --repo argument is placed inside the command argument of shell_exec. As an example, an attacker could use the --repo argument |touch /root/nagios-was-here|. The full restic command is assembled to the string restic --json --repo=|touch /root/nagios-was-here| --password-file= check before it is passed to shell_exec. shell_exec then splits the command up in three parts at the | boundaries and executes the parts separately, which also executes the embedded command touch /root/nagios-was-here.
PoC
This PoC shows how the nagios user can use this to create a file inside /root.
nagios@test-vm:/$ sudo /usr/lib64/nagios/plugins/restic-check --repo '|touch /root/nagios-was-here|'Impact
The vulnerability is a local privilege escalation.
Fix
Switch from | to an array
Remove the | split functionality. Instead, modify shell_exec to accept either a string or an array of strings. If an array is provided, the commands are chained together like they currently are when using |. If a string is provided, no split should be performed. You could also introduce a separate function like shell_exec_with_user_input() which implements this such that the current shell_exec function can stay like it is.
This leaves the problem that an attacker can still specify arbitrary arguments inside a command. An example for this would be to use the --repo argument sftp://example.com --cache-dir /tmp, which would lead to the execution of: restic --json --repo=sftp://example.com --cache-dir /tmp --password-file=None check. Please note that this example should mainly highlight the problem in general. To prevent the problem, there is either escaping or again array-syntax. Escaping would use shlex.quote to place the user provided argument inside quotes and which also escapes everything which needs to be escaped. Using array syntax would mean providing the full command as an array like ['restic', '--json', '--repo', 'sftp://example.com']. The array can then be given as-is to Popen. With this method, the proposed shell_exec_with_user_input would accept an array of array of strings.
Patches
The fix follows the array-syntax approach proposed above:
linuxfabrik-lib5.0.0:lib.shell.shell_exec()requires the command as a list of
arguments (argv) and always runs with shell=False. The | split functionality, command strings and the shell= parameter have been removed, so user-provided input can no longer break out of a command. lib.shell.safe_cli_value() additionally guards positional arguments (such as an ssh destination or a ping target) against option injection, and lib.ssh builds argument lists as well.
- Linuxfabrik Monitoring Plugins: all plugins assemble their external commands as argv lists
(commit 23bb570f4). Contained in every release after v5.2.0.
Executive ViewAI
Linuxfabrik Monitoring Plugins contain a local privilege escalation vulnerability allowing attackers with nagios account access to execute arbitrary commands as root. Organizations using these plugins face critical risk to infrastructure managed through monitoring systems, with exploitation requiring minimal prerequisites beyond existing account access.
Restrict nagios account to minimal permissions required for monitoring; disable or sandbox shell_exec() functionality in plugin library calls; implement strict input validation and sanitization for all user-controlled plugin arguments before shell invocation; isolate monitoring plugins in separate containers or user namespaces; enable command execution logging and alerting on nagios account activity; apply vendor-recommended workarounds from advisory when available pending patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB