EUVD-2026-55977
GHSA-pqrp-p4c6-2q4g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Local attack requiring low-privilege account; no user interaction; high C and I from arbitrary sensitive file ownership takeover; no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.
AnalysisAI
Privilege escalation in MRTG (Multi Router Traffic Grapher) allows a local low-privileged attacker to gain elevated file ownership on the host system. When the MRTG daemon is launched as root and then drops privileges, a CWE-59 symlink-following flaw in PID file handling lets an attacker pre-place or manipulate a symlink at the expected PID file path, causing the root process to change ownership of an arbitrary existing file to the daemon user. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
MRTG is a network traffic monitoring tool that historically required root-level startup to bind low ports or access raw interfaces, after which it drops to an unprivileged daemon user. The vulnerability resides in its PID file management: during the privilege drop sequence, the root process writes or chowns the PID file without safely resolving symbolic links first (CWE-59 - Improper Link Resolution Before File Access). On Linux systems, this race condition or pre-placement opportunity allows an attacker who controls a writable ancestor directory to substitute a symlink pointing to any system file (e.g., /etc/passwd, /etc/shadow, an SSH authorized_keys file). The chown call then executes as root on the symlink's target, transferring ownership to the daemon UID. Affected CPEs span the MRTG package as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10.
RemediationAI
Apply the vendor-supplied errata package from Red Hat once available via the Red Hat Customer Portal at https://access.redhat.com/security/cve/CVE-2026-72694. No exact fixed package version was confirmed in the available intelligence, so monitor https://bugzilla.redhat.com/show_bug.cgi?id=2460973 for patch status updates. As a compensating control, avoid running the MRTG daemon as root where possible - configure it to start under a dedicated low-privilege user from the outset, eliminating the privilege drop step that triggers the vulnerable code path; this removes the attack surface entirely but may require adjusting port bindings or interface permissions. If root startup is unavoidable, ensure that the directory containing the PID file is owned by root and not writable by unprivileged users (chmod 755 or stricter), which prevents symlink pre-placement. Additionally, enabling and enforcing Linux Security Module (SELinux or AppArmor) policies on MRTG can constrain the chown operation to prevent arbitrary file retargeting, though policy tuning is required and may affect MRTG functionality.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today