# CVE-2026-67436: Linuxfabrik monitoring-plugins SSRF and credential disclosure in redfish plugins

Source: https://junglewise.ai/threats/cve-2026-67436-linuxfabrik-monitoring-plugins-ssrf-and-credential-disclosure-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-67436 · Severity: info · CVSS 8.3 · Published 2026-07-29

Linuxfabrik monitoring-plugins provides tools for monitoring IT infrastructure health. A vulnerability in the Redfish monitoring components allows a compromised or malicious hardware controller to trick the monitoring system into sending sensitive login credentials to an attacker-controlled server. This could lead to the theft of administrative tokens or allow an attacker to probe other internal systems on the management network.

Technologies: [Linuxfabrik Monitoring-Plugins](https://junglewise.ai/threats/technologies/monitoring-plugins). Vendors: [Linuxfabrik](https://junglewise.ai/threats/vendors/linuxfabrik).

## Quick answers

**Is CVE-2026-67436 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67436 being exploited in the wild.

**How severe is CVE-2026-67436?** Informational severity, with a CVSS score of 8.3, published 29 July 2026.

**Which products and versions are affected?** Linuxfabrik Monitoring-Plugins <= 6.0.0.

**Is there a fix for CVE-2026-67436?** A patch was published on 2026-07-07: Fixed in version 6.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67436 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-67436?** Check whether you run Linuxfabrik Monitoring-Plugins at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) and information disclosure vulnerability exists in the redfish-* plugins of Linuxfabrik monitoring-plugins version 6.0.0 and earlier. The plugins discover sub-resources by concatenating the operator-supplied base URL with '@odata.id' hypermedia links returned by the monitored Baseboard Management Controller (BMC) without validating that the link is a relative path. An attacker-controlled BMC can return a specially crafted link (e.g., starting with '@' or '//') to redirect the plugin's next request to an arbitrary host. Because these subsequent requests include the Redfish X-Auth-Token or HTTP Basic authentication headers, the attacker can exfiltrate credentials or use the monitoring host as a pivot for blind SSRF. The issue is fixed in version 6.0.1 by ensuring all response-derived links are validated as single-slash-rooted relative paths.

## Affected products

- Linuxfabrik monitoring-plugins <= 6.0.0

## Timeline

- 2026-07-07: patched: Fixed in version 6.0.1
- 2026-07-29: advisory: GitHub Advisory GHSA-96fx-pqc3-28xv published

## References

- [https://github.com/Linuxfabrik/monitoring-plugins/commit/ffb0a81308cbfc018da857a89e0d07a67bf89fc3](https://github.com/Linuxfabrik/monitoring-plugins/commit/ffb0a81308cbfc018da857a89e0d07a67bf89fc3)
- [https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-96fx-pqc3-28xv](https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-96fx-pqc3-28xv)

## Related threats

- [Linuxfabrik monitoring-plugins arbitrary root file read via --test argument](https://junglewise.ai/threats/cve-2026-73974-linuxfabrik-monitoring-plugins-arbitrary-root-file-read-via-test)
- [Linuxfabrik monitoring-plugins symlink following in logfile migration](https://junglewise.ai/threats/cve-2026-67433-linuxfabrik-monitoring-plugins-symlink-following-in-logfile)
- [Linuxfabrik Monitoring Plugins OS command injection in shell_exec](https://junglewise.ai/threats/cve-2026-55426-linuxfabrik-monitoring-plugins-os-command-injection-in-shell-exec)
- [Linuxfabrik Monitoring Plugins privilege escalation in Debian.sudoers](https://junglewise.ai/threats/cve-2026-52817-linuxfabrik-monitoring-plugins-privilege-escalation-in-debian)