CVE-2026-67436: Linuxfabrik monitoring-plugins SSRF and credential disclosure in redfish plugins

CVE-2026-67436 · Severity: info · CVSS 8.3 · Published 2026-07-29

Linuxfabrik monitoring-plugins provides tools for monitoring IT infrastructure health. A vulnerability in the Redfish monitoring components allows a compromised or malicious hardware controller to trick the monitoring system into sending sensitive login credentials to an attacker-controlled server. This could lead to the theft of administrative tokens or allow an attacker to probe other internal systems on the management network.

Technologies: Linuxfabrik Monitoring-Plugins. Vendors: Linuxfabrik.

Quick answers

Is CVE-2026-67436 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-67436 being exploited in the wild.
How severe is CVE-2026-67436?
Informational severity, with a CVSS score of 8.3, published 29 July 2026.
Which products and versions are affected?
Linuxfabrik Monitoring-Plugins <= 6.0.0.
Is there a fix for CVE-2026-67436?
A patch was published on 2026-07-07: Fixed in version 6.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67436 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-67436?
Check whether you run Linuxfabrik Monitoring-Plugins at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) and information disclosure vulnerability exists in the redfish-* plugins of Linuxfabrik monitoring-plugins version 6.0.0 and earlier. The plugins discover sub-resources by concatenating the operator-supplied base URL with '@odata.id' hypermedia links returned by the monitored Baseboard Management Controller (BMC) without validating that the link is a relative path. An attacker-controlled BMC can return a specially crafted link (e.g., starting with '@' or '//') to redirect the plugin's next request to an arbitrary host. Because these subsequent requests include the Redfish X-Auth-Token or HTTP Basic authentication headers, the attacker can exfiltrate credentials or use the monitoring host as a pivot for blind SSRF. The issue is fixed in version 6.0.1 by ensuring all response-derived links are validated as single-slash-rooted relative paths.

Affected products

  • Linuxfabrik monitoring-plugins <= 6.0.0

Timeline

  • 2026-07-07: patched: Fixed in version 6.0.1
  • 2026-07-29: advisory: GitHub Advisory GHSA-96fx-pqc3-28xv published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.