Executive brief
Linuxfabrik's monitoring plugins (used to gather system and application health data in Nagios/Icinga environments) contain a hidden --test argument that allows reading arbitrary files on disk when the plugin runs as root. An attacker with access to the unprivileged nagios or icinga account can abuse sudoers-whitelisted plugins to retrieve sensitive files like password databases and encryption keys, leading to full system compromise.
Technical details
The vulnerability exists in lib.lftest.test() (lftest.py lines 659-664), which unconditionally opens and reads files specified in the first CSV element of the --test argument: `stdout = args[0]; if stdout and os.path.isfile(stdout): _, stdout = disk.read_file(stdout)`. The --test argument is registered with type=lib.args.csv on ~23 whitelisted plugins (e.g., deb-updates, docker-info) and is centrally suppressed from --help but remains accepted on the command line at runtime. No path confinement checks protect the file path. When invoked via sudoers by a nagios/icinga user, plugins execute as root. The deb-updates plugin provides full file disclosure (every line printed); other plugins leak filtered content or act as existence/readability oracles depending on their downstream parsers. An attacker controlling the nagios account can retrieve /etc/shadow, /root/.ssh/id_rsa, TLS certificates, and cloud credentials.
Affected products
- Linuxfabrik linuxfabrik-lib < 6.1.0
- Linuxfabrik monitoring-plugins (deb-updates, docker-info, openvpn-client-list, and ~20 others) all versions using linuxfabrik-lib <= 6.0.0
Timeline
- 2026-07-08: disclosed: Published to GitHub Advisory Database
- 2026-08-18: advisory: Advisory GHSA-rh9c-rqvg-f7pr and CVE-2026-73974 issued
- 2026-08-18: patched: linuxfabrik-lib v6.1.0 released with fix (commit d665042)