Linuxfabrik monitoring-plugins CVE-2026-67436

Exploitation requires that a Linuxfabrik redfish-* plugin (v6.0.0 or earlier) performs an authenticated Redfish check against a BMC that the attacker controls or has compromised, because the malicious server must return a crafted @odata.id link value that redirects the plugin's next authenticated request to an attacker-chosen host. The plugin must be configured with credentials (X-Auth-Token session auth or HTTP Basic), since the disclosed asset is those credentials. Limiting factors: the attacker cannot trigger this against an arbitrary victim on the internet - they need the monitoring server to poll a hostile Redfish endpoint, which normally means either compromising a legitimate BMC on the management network or convincing an operator to target a rogue host (this is the CVSS 4.0 AT:P attack requirement). Deployments that monitor only trusted, network-isolated BMCs substantially limit realistic exposure.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VC:H/VI:L/VA:N, no subsequent-system impact) reflects a network-reachable, low-complexity issue whose realism hinges on the AT:P 'attack requirement': the attacker must already control or compromise a BMC that the monitoring host chooses to poll, or must convince an operator to point a redfish-* check at a hostile endpoint. That is a meaningful gating condition - this is not a spray-and-pray internet exploit but a trust-boundary flaw between a monitoring server and the devices it monitors, which are typically on management VLANs. The primary impact is confidentiality (VC:H): leakage of a live Redfish auth token or Basic credentials, which an attacker can replay against the legitimate BMC to gain management-plane access to the server. There is no EPSS score, KEV entry, SSVC decision, or public POC in the provided data, so exploitation probability cannot be quantified; the absence of these signals suggests it is not currently subject to widespread automated exploitation. Net: a credible, high-impact issue for organizations that monitor untrusted or internet-adjacent BMCs, but of lower urgency where BMCs are strictly isolated and trusted. Note the 8.3 score is derived from CVSS 4.0 only; no CVSS 3.1 vector was provided in the input.

An attacker who has compromised a server's BMC (or who lures an operator into monitoring a rogue Redfish endpoint) returns a crafted JSON response whose @odata.id points at an attacker-controlled host. When the Linuxfabrik redfish-* plugin follows that link, it re-sends the operator's X-Auth-Token or HTTP Basic credentials to the attacker's server, which captures them and replays them against the real BMC for management-plane access. No public exploit is identified at time of analysis, but the technique is straightforward given the low attack complexity.