# CVE-2026-67433: Linuxfabrik monitoring-plugins symlink following in logfile migration

Source: https://junglewise.ai/threats/cve-2026-67433-linuxfabrik-monitoring-plugins-symlink-following-in-logfile  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-67433 · Severity: info · CVSS 5.8 · Published 2026-07-29

Linuxfabrik monitoring-plugins is a collection of Python scripts used to monitor system health in IT environments. A security flaw in version 6.0.0 allows a local attacker to trick the system into modifying or corrupting files they should not have access to. This occurs during a background database migration process and could lead to data corruption or unauthorized file changes if the system is not configured with standard modern security protections.

Technologies: [Linuxfabrik Monitoring-Plugins](https://junglewise.ai/threats/technologies/monitoring-plugins). Vendors: [Linuxfabrik](https://junglewise.ai/threats/vendors/linuxfabrik).

## Quick answers

**Is CVE-2026-67433 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67433 being exploited in the wild.

**How severe is CVE-2026-67433?** Informational severity, with a CVSS score of 5.8, published 29 July 2026.

**Which products and versions are affected?** Linuxfabrik Monitoring-Plugins 6.0.0.

**Is there a fix for CVE-2026-67433?** A patch was published on 2026-07-07: Fixed in version 6.0.1 via removal of migration logic Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67433 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-67433?** Check whether you run Linuxfabrik Monitoring-Plugins at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A symlink following vulnerability (CWE-59) exists in the logfile check's legacy database migration logic in Linuxfabrik monitoring-plugins v6.0.0. The plugin attempts to move a database from a predictable, world-writable path in /tmp using os.rename() to a secured directory. A local attacker controlling the plugin's service account can place a symlink at the predictable path; because os.rename() moves the symlink itself into the secure directory, subsequent validation is bypassed, and sqlite3.connect() follows the link while running as root. This allows for arbitrary file corruption or redirection of SQLite writes to unintended files, though it primarily affects systems where fs.protected_symlinks is disabled. The migration logic was removed in version 6.0.1 to resolve the issue.

## Affected products

- Linuxfabrik monitoring-plugins 6.0.0

## Timeline

- 2026-07-07: advisory: GitHub Security Advisory GHSA-w2gg-hx6w-24w3 published
- 2026-07-29: disclosed: CVE-2026-67433 published to NVD
- 2026-07-07: patched: Fixed in version 6.0.1 via removal of migration logic

## References

- [https://github.com/Linuxfabrik/monitoring-plugins/commit/6df1f574aa9dc6541e092f1ce482ecc1315cded0](https://github.com/Linuxfabrik/monitoring-plugins/commit/6df1f574aa9dc6541e092f1ce482ecc1315cded0)
- [https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-w2gg-hx6w-24w3](https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-w2gg-hx6w-24w3)

## Related threats

- [Linuxfabrik monitoring-plugins arbitrary root file read via --test argument](https://junglewise.ai/threats/cve-2026-73974-linuxfabrik-monitoring-plugins-arbitrary-root-file-read-via-test)
- [Linuxfabrik monitoring-plugins SSRF and credential disclosure in redfish plugins](https://junglewise.ai/threats/cve-2026-67436-linuxfabrik-monitoring-plugins-ssrf-and-credential-disclosure-in)
- [Linuxfabrik Monitoring Plugins OS command injection in shell_exec](https://junglewise.ai/threats/cve-2026-55426-linuxfabrik-monitoring-plugins-os-command-injection-in-shell-exec)
- [Linuxfabrik Monitoring Plugins privilege escalation in Debian.sudoers](https://junglewise.ai/threats/cve-2026-52817-linuxfabrik-monitoring-plugins-privilege-escalation-in-debian)