EUVD-2026-62185
GHSA-rh9c-rqvg-f7pr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain nagios/icinga account shell access
-
DeliveryInvoke sudoers-whitelisted plugin via sudo with --test=<target_path>,,0
-
Exploitlftest.py reads supplied path as root without path confinement
-
ExecutionPlugin parses file contents as operational output data
-
ImpactFull or filtered file contents echoed to attacker stdout
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires all three of the following: (1) the attacker controls the nagios or icinga low-privilege OS account - this is the explicitly documented threat model for the shipped sudoers allowlist and the same precondition as CVE-2026-52817; (2) the target host uses the Linuxfabrik-shipped sudoers allowlist (e.g., Debian.sudoers) granting passwordless sudo for the plugin binaries without argument-level restrictions; and (3) linuxfabrik-lib version 6.0.0 or earlier is installed. No non-default configuration, feature flag, or special runtime state is required - the --test argument is hidden from --help but permanently enabled in all unpatched releases. Full plaintext disclosure of every line of the target file is achieved via deb-updates with its defaults (--query='1', --only-critical=False); filtered disclosure of warning:/error: lines is available via docker-info; CLIENT_LIST lines are leaked via openvpn-client-list; and any plugin with a strict downstream parser yields at minimum a file existence and readability oracle. The key factors limiting exploitation are: the attacker must already hold the nagios/icinga account (no remote unauthenticated path), and the sudoers file must not restrict arguments - organizations that have hardened sudoers entries to specific permitted arguments are not exposed. |
| Impact | The provided CVSS 3.1 base score of 5.5 (Medium) correctly captures the local attack vector and low-privilege prerequisite, but it materially understates the practical impact severity: the capability to read /etc/shadow, root SSH private keys, TLS certificate private keys, or cloud credential files at will constitutes a near-direct path to full system compromise and lateral movement across the monitored fleet, far beyond what a Medium label typically implies. No EPSS score was included in the source data, so exploitation probability cannot be quantified numerically; however, the barrier to exploitation is trivially low - one shell command with a publicly disclosed proof-of-concept, no guesswork, and no special tooling required. CISA KEV status is not confirmed at time of analysis, indicating active widespread exploitation has not yet been observed by US federal visibility, but the attack is fully scripted and disclosed. SSVC signals are unfavorable: exploitation is public and straightforward, the attack is automatable against any host in the standard deployment model, and the technical impact on confidentiality is total. The primary limiting factor is possession of the nagios or icinga account - but this is the documented intended deployment model, meaning any organization following the vendor's recommended installation is fully exposed without additional hardening. The conflict between the Medium CVSS and the high practical impact warrants escalated triage priority regardless of the numeric score. |
| Exploit ScenarioDerived | An attacker with shell access as the nagios user runs the single command sudo /usr/lib64/nagios/plugins/deb-updates --test=/etc/shadow,,0 against a host using the shipped sudoers allowlist; the plugin invokes lftest.py as root, which reads /etc/shadow in full and returns its contents as simulated stdout, after which deb-updates inserts each line as a package row in SQLite and prints all rows under the default permissive WHERE 1 query, delivering the complete shadow password database to the attacker's terminal. A working proof-of-concept for this exact command is publicly disclosed in the GHSA-rh9c-rqvg-f7pr advisory, and a variant routing the target path through the stderr channel of docker-info provides filtered line-level disclosure of the same file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Arbitrary root file read in Linuxfabrik monitoring plugins allows a local attacker controlling the nagios or icinga account to exfiltrate any root-readable file by exploiting the hidden but permanently live --test argument accepted by all sudoers-whitelisted check plugins. Invoking the deb-updates plugin via sudo with --test=/etc/shadow,,0 causes lftest.py to read the supplied path as root with no path confinement and echo its full contents to stdout; approximately 22 additional whitelisted plugins yield filtered leaks or file-existence oracles through the same mechanism. No active exploitation has been confirmed by CISA KEV, but a fully functional proof-of-concept command is publicly disclosed in the vendor's own GitHub security advisory GHSA-rh9c-rqvg-f7pr, and patches are available in linuxfabrik-lib v6.1.0 and monitoring-plugins v7.0.0.
RemediationAI
Upgrade linuxfabrik-lib to version 6.1.0 or later (vendor-released patch confirmed; patching commit d665042c55fae83a295ebc0023e8b77f6c473a28, release tag at https://github.com/Linuxfabrik/lib/releases/tag/v6.1.0), and upgrade monitoring-plugins to version 7.0.0 or later (patching commit f6680a9e4b39569f318feefdb2f51e5d18c7dad5, release at https://github.com/Linuxfabrik/monitoring-plugins/releases/tag/v7.0.0). The fix confines all --test fixture reads to the calling plugin's own unit-test/ directory anchored to sys.argv[0] via realpath() containment, with symlink-anchor detection, closing the arbitrary path read. If immediate upgrade is not feasible, the most effective compensating control is amending each sudoers entry to explicitly enumerate permitted argument forms and exclude --test; this eliminates the attack surface without disabling monitoring but requires manual enumeration of all allowed argument patterns per plugin and carries ongoing maintenance cost when plugins are updated. As a secondary measure, auditing and restricting which accounts have access to the nagios/icinga login reduces the pool of potential attackers but does not close the vulnerability. Both workarounds should be treated as temporary bridges to patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) in lftest.py lines 659-664 of the linuxfabrik-lib Python library (CPE: pkg:pip/linuxfabrik-lib). The shared lib.lftest.test() function, consumed by every Linuxfabrik check plugin, accepts a CSV-typed argument whose first element is assigned to a variable named stdout and then read unconditionally via disk.read_file() whenever os.path.isfile() returns true - with zero path confinement on the caller-supplied value. The --test argument is registered in argparse with the SUPPRESS action, hiding it from --help output but leaving it fully operational at runtime in all releases through v6.0.0, making it a de-facto undocumented production argument. Because the vendor-shipped sudoers allowlist (e.g., Debian.sudoers) grants the nagios and icinga accounts passwordless sudo for the plugin binaries without restricting argument values, any user in those groups can pass --test with an arbitrary filesystem path, causing the plugin to open and return that file's contents while executing as root. The deb-updates plugin achieves full plaintext file disclosure because each returned line is inserted into an in-memory SQLite table and then selected by the default permissive query (WHERE 1) and printed verbatim. The fix in lib v6.1.0 anchors all fixture reads to the calling plugin's own unit-test/ directory using realpath() containment checks, and also refuses symlinked anchors to prevent writable-directory attacks.
Know when Docker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack vector and low-privilege nagios account required; exploitation yields full confidentiality breach but no write access or availability impact.
Primary rating from Vendor (https://github.com/Linuxfabrik/monitoring-plugins).
CVSS VectorVendor: https://github.com/Linuxfabrik/monitoring-plugins
DescriptionCVE.org
Summary
Every Linuxfabrik check plugin that supports the shared --test argument (routed through lib.lftest.test()) will, when --test is supplied, treat the first CSV element as a filesystem path and read its full contents as the plugin's simulated STDOUT - running as root when the plugin is invoked through the shipped nagios/icinga sudoers allowlist. --test is a live production argument (centrally mapped to argparse.SUPPRESS, so it is hidden from --help but still accepted on the command line), not a build-time-only gate. This yields an arbitrary root file-read primitive (full disclosure on deb-updates; filtered disclosure / existence-and-readability oracle on ~22 other whitelisted plugins), i.e. local privilege escalation from the nagios account to root.
Root Cause
lib.lftest.test(args)(lftest.pylines 659-664):stdout = args[0];if stdout and os.path.isfile(stdout): _, stdout = disk.read_file(stdout). Element[1] (stderr channel) is read the same way. There is no path confinement on the supplied path.check-plugins/deb-updates/deb-updates:--testis registered withtype=lib.args.csv(lines 78-82). When supplied, control flows tostdout, _, retc = lib.lftest.test(args.TEST)(line 143), bypassing the apt path (if args.TEST is None:at 121). Each returned line is stored as apackagerow and, under the default--query='1'(WHERE 1, matches all rows), every row is printed via'\n* '.join([row['package'] ...])→lib.base.oao(...).- The same
--test/lib.lftest.test()mechanism exists identically on ~22 whitelisted plugins (e.g.docker-info), each performing a rootopen()/read of the attacker-named path. Disclosure degree varies by each plugin's downstream parser: full (deb-updates), filtered (docker-infoechoes lines containingwarning:/error:;openvpn-client-listechoesCLIENT_LISTlines), or existence/readability oracle (JSON parsers).
Impact
An attacker controlling the low-privilege nagios/icinga account (the documented threat model for the shipped sudoers file - same precondition as CVE-2026-52817) obtains the full contents of any root-readable file via deb-updates (e.g. /etc/shadow, /root/.ssh/id_*, TLS keys, cloud credentials), plus a fleet-wide root file existence/readability oracle and filtered content leak via the other plugins → local privilege escalation to root.
Proof of Concept
Full disclosure (deb-updates):
sudo /usr/lib64/nagios/plugins/deb-updates --test=/etc/shadow,,0Filtered disclosure / oracle (docker-info, target routed to the stderr channel that gets echoed):
sudo /usr/lib64/nagios/plugins/docker-info --test="dummy,/etc/shadow,0"Attack Chain
- Entry:
sudo /usr/lib64/nagios/plugins/deb-updates --test=/etc/shadow,,0
- Action: the nagios user invokes the whitelisted plugin as root with a
--testCSV whose element[0] is the target path and retc=0. - Guard: sudoers (Debian.sudoers:3) lists the binary only;
--testis not gated to test builds. - Bypass proof: CONTRIBUTING.md documents
--testas centrally mapped toargparse.SUPPRESS- hidden from--helpbut still accepted on the command line;lib.args.csvsplits/etc/shadow,,0into['/etc/shadow','','0'].
- Sink:
lib.lftest.test(args.TEST)(deb-updates:143) reads element[0] as a file, as root.
- Guard: none - no path confinement on element[0].
- Bypass proof (from lib source):
lftest.py:661-664:stdout = args[0]; if stdout and os.path.isfile(stdout): _, stdout = disk.read_file(stdout)- element[0], if it exists on disk, is opened and its contents returned as stdout.retc=0(element[2]) so there is no earlycu()abort.
- Store + query: each line →
lib.db_sqlite.insert(conn, {'package': item}, ...); defaultQUERY='1'→SELECT * FROM deb_updates WHERE 1.
- Guard:
--only-criticalor a restrictive--querywould filter, but both default to permissive (ONLY_CRITICAL=False,QUERY='1'). - Bypass proof: attacker passes neither → all rows selected.
- Disclosure:
msg += '\n* '.join([row['package'] for row in result])→lib.base.oao(...)→ stdout.
- Guard: none.
- Bypass proof: with
len(result) > 0the branch prints every row (every file line).
- Impact: full contents of any root-readable file disclosed to the nagios user → root. On the ~22 other
--testplugins the same primitive yields a filtered leak / universal root file existence-and-readability oracle.
Bypass Evidence
lib.lftest.test()file-read behavior verified directly from linuxfabrik-lib source (lftest.py:659-664,disk.read_file(stdout)whenos.path.isfile(stdout)).--testregistration (type=lib.args.csv) and thestdout, _, retc = lib.lftest.test(args.TEST)call verified on the latest release tag v6.0.0 atcheck-plugins/deb-updates/deb-updates:143(GitHub contents API); defaultQUERY='1'confirmed.- No path-confinement guard exists on the
--testpath element in either the plugin orlib.lftest.
Affected Versions
<= 6.0.0 (latest release; --test/lib.lftest.test() flow present on tag v6.0.0). Not covered by any existing advisory (none reference --test or arbitrary file read).
Suggested Fix
Compile --test out of production builds (or gate it behind an explicit build/dev flag so it is not accepted at runtime), OR confine the --test path element(s) to a dedicated fixtures directory via realpath() + containment check before disk.read_file(). As defense-in-depth, constrain the sudoers entries to specific argument values so --test cannot be supplied to a root-run plugin.
--- Reported by zx (Jace)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Unauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Exploit-DB