Executive brief
Linuxfabrik monitoring-plugins provides tools for monitoring IT infrastructure health. A vulnerability in the Redfish monitoring components allows a compromised or malicious hardware controller to trick the monitoring system into sending sensitive login credentials to an attacker-controlled server. This could lead to the theft of administrative tokens or allow an attacker to probe other internal systems on the management network.
Technical details
A Server-Side Request Forgery (SSRF) and information disclosure vulnerability exists in the redfish-* plugins of Linuxfabrik monitoring-plugins version 6.0.0 and earlier. The plugins discover sub-resources by concatenating the operator-supplied base URL with '@odata.id' hypermedia links returned by the monitored Baseboard Management Controller (BMC) without validating that the link is a relative path. An attacker-controlled BMC can return a specially crafted link (e.g., starting with '@' or '//') to redirect the plugin's next request to an arbitrary host. Because these subsequent requests include the Redfish X-Auth-Token or HTTP Basic authentication headers, the attacker can exfiltrate credentials or use the monitoring host as a pivot for blind SSRF. The issue is fixed in version 6.0.1 by ensuring all response-derived links are validated as single-slash-rooted relative paths.
Affected products
- Linuxfabrik monitoring-plugins <= 6.0.0
Timeline
- 2026-07-07: patched: Fixed in version 6.0.1
- 2026-07-29: advisory: GitHub Advisory GHSA-96fx-pqc3-28xv published