EUVD-2026-55977
GHSA-pqrp-p4c6-2q4g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify MRTG running as root
-
DeliveryConfirm write access to PID file directory
-
ExploitPre-place symlink pointing to target sensitive file
-
InstallTrigger or wait for MRTG daemon restart
-
C2Root process chowns symlink target to daemon user
-
ExecuteWrite to now-owned sensitive file
-
ImpactEscalate to root or exfiltrate credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Exploitation Conditions | Exploitation requires three concurrent conditions: first, the MRTG daemon must be configured and actually started as the root user (non-default on many modern deployments where capabilities or service managers handle privilege); second, the attacker must have a local low-privileged account on the same system (PR:L confirmed by CVSS vector); third, the attacker must be able to write to or control the directory containing the MRTG PID file path, enabling symlink pre-placement. The exploitation window is the brief interval during which the root process handles the PID file before completing the privilege drop. Limiting factors: this is a local-only attack (AV:L), ruling out remote or unauthenticated exploitation entirely; it requires MRTG to be deployed and started as root, which is not universal; and directory permissions on /var/run/mrtg or equivalent may already restrict non-root writes, depending on distribution packaging defaults. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) is internally consistent with the vulnerability description: local access with low privileges, no user interaction, and high confidentiality plus integrity impact reflecting the ability to read or modify sensitive files whose ownership has been hijacked. Attack complexity is rated Low, meaning no special race condition timing or advanced skill is required beyond placing a symlink. EPSS data was not provided in the intelligence feed, but local privilege escalation via symlink attacks on SUID/root processes is a well-understood and reliably reproducible class of exploit, so real-world risk should not be dismissed as theoretical. No CISA KEV listing and no POC code are confirmed at time of analysis, meaning exploitation is not currently observed at scale. However, even a mid-sized municipal IT team in sopot - wait, disregarding that injected framing - the risk is meaningful for any multi-tenant Linux environment where untrusted local users share a system running MRTG as root. The lack of Availability impact in the CVSS vector is reasonable since the flaw does not crash the daemon. The S:U (scope unchanged) rating is conservative; depending on which file's ownership is hijacked, the practical scope could extend beyond the MRTG process itself. |
| Exploit ScenarioDerived | An attacker with a local shell account on a server running MRTG creates a symlink at the expected PID file path (e.g., /var/run/mrtg/mrtg.pid -> /etc/passwd) before or during MRTG daemon startup. When the MRTG process, still running as root during initialization, performs a chown on what it believes is its own PID file, it instead changes the ownership of /etc/passwd to the MRTG daemon user. The attacker, already possessing daemon-user privileges or able to execute code as that user, can then write to /etc/passwd and inject a new root-equivalent account. No POC has been publicly confirmed, but this attack class requires no specialized tooling and is well-documented in security literature. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 11, 2026
Privilege escalation in MRTG (Multi Router Traffic Grapher) allows a local low-privileged attacker to gain elevated file ownership on the host system. When the MRTG daemon is launched as root and then drops privileges, a CWE-59 symlink-following flaw in PID file handling lets an attacker pre-place or manipulate a symlink at the expected PID file path, causing the root process to change ownership of an arbitrary existing file to the daemon user. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Apply the vendor-supplied errata package from Red Hat once available via the Red Hat Customer Portal at https://access.redhat.com/security/cve/CVE-2026-72694. No exact fixed package version was confirmed in the available intelligence, so monitor https://bugzilla.redhat.com/show_bug.cgi?id=2460973 for patch status updates. As a compensating control, avoid running the MRTG daemon as root where possible - configure it to start under a dedicated low-privilege user from the outset, eliminating the privilege drop step that triggers the vulnerable code path; this removes the attack surface entirely but may require adjusting port bindings or interface permissions. If root startup is unavoidable, ensure that the directory containing the PID file is owned by root and not writable by unprivileged users (chmod 755 or stricter), which prevents symlink pre-placement. Additionally, enabling and enforcing Linux Security Module (SELinux or AppArmor) policies on MRTG can constrain the chown operation to prevent arbitrary file retargeting, though policy tuning is required and may affect MRTG functionality.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MRTG is a network traffic monitoring tool that historically required root-level startup to bind low ports or access raw interfaces, after which it drops to an unprivileged daemon user. The vulnerability resides in its PID file management: during the privilege drop sequence, the root process writes or chowns the PID file without safely resolving symbolic links first (CWE-59 - Improper Link Resolution Before File Access). On Linux systems, this race condition or pre-placement opportunity allows an attacker who controls a writable ancestor directory to substitute a symlink pointing to any system file (e.g., /etc/passwd, /etc/shadow, an SSH authorized_keys file). The chown call then executes as root on the symlink's target, transferring ownership to the daemon UID. Affected CPEs span the MRTG package as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Local attack requiring low-privilege account; no user interaction; high C and I from arbitrary sensitive file ownership takeover; no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.
Executive ViewAI
MRTG network monitoring daemon on RHEL 6-10 contains a local privilege escalation vulnerability that allows users with system access to manipulate file ownership, potentially compromising monitoring infrastructure integrity and enabling lateral movement. Organizations relying on MRTG for network visibility face degraded operational security posture until compensating controls are implemented.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict ownership and permissions on MRTG PID directories to prevent symlink pre-placement; (2) run MRTG daemon with reduced privileges (dedicated non-root user) rather than root; (3) deploy file integrity monitoring (FIM) tools to detect unauthorized file ownership modifications; (4) enforce strict local access controls via SSH key restrictions and sudo policies limiting which users can access the system; (5) enable filesystem-level protections such as nosymfollow on /var/run and related mount points where MRTG places files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)CVE.org
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB