linuxfabrik-lib EUVD-2026-50553

Exploitation requires all of the following: (1) the monitoring plugin must be configured to pass credential headers beyond Authorization and Cookie - most critically X-Auth-Token (Redfish/BMC) or X-Api-Key, which are common in Linuxfabrik's hardware monitoring checks; (2) the attacker must control or be able to influence a monitored endpoint to return an HTTP 3xx redirect to an attacker-controlled host - achievable via a compromised monitored device, DNS poisoning of the monitoring server's resolver, or ARP spoofing on the monitoring VLAN; (3) the calling context must have low-privilege credentials (PR:L - the monitoring process is authenticated to the target). Exploitation is bounded by AT:P: the redirect injection must occur in the specific network path between the monitoring server and the monitored endpoint. Monitoring deployments that use only the standard Authorization or Cookie headers are not affected, as httpx strips those by default. Environments where the monitoring server has strict egress controls preventing unexpected redirect destinations are also substantially protected.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N, score 6.0) reflects a nuanced threat: network-reachable and requiring only low-privilege caller context, but gated behind an attack precondition (AT:P) - the attacker must control or compromise a host that can issue HTTP 3xx redirects in the monitoring path. Practical attack vectors include a compromised monitored device (BMC, switch, server) returning a redirect, DNS poisoning, or ARP spoofing on the monitoring VLAN. Confidentiality impact is rated High because harvested tokens like X-Auth-Token can grant full administrative control over monitored hardware, making the downstream blast radius much larger than a simple data leak. No EPSS data was provided in the input; the absence of KEV listing and public POC lowers immediacy, but environments monitoring hardware via Redfish should treat this as a high-priority patch given the privilege level of the credentials at risk. The VI:L metric in the vector is consistent with the attacker being able to use stolen tokens to make configuration changes on monitored devices - a secondary integrity risk beyond the primary credential theft.

An attacker who has compromised a BMC or network device being monitored by Linuxfabrik monitoring-plugins modifies the device's HTTP response to issue a 301 redirect pointing to an attacker-controlled server. The monitoring plugin's lib.url.fetch() follows the redirect and forwards the X-Auth-Token used for Redfish authentication to the attacker's server. The attacker captures the token and uses it to log into the BMC with full administrative privileges, enabling firmware modification, power cycling, or credential harvesting across the managed server fleet.