CVE-2026-73974: Linuxfabrik monitoring-plugins arbitrary root file read via --test argument

CVE-2026-73974 · Severity: medium · CVSS 5.5 · Published 2026-08-18

Linuxfabrik's monitoring plugins (used to gather system and application health data in Nagios/Icinga environments) contain a hidden --test argument that allows reading arbitrary files on disk when the plugin runs as root. An attacker with access to the unprivileged nagios or icinga account can abuse sudoers-whitelisted plugins to retrieve sensitive files like password databases and encryption keys, leading to full system compromise.

Technologies: Linuxfabrik Monitoring-Plugins, linuxfabrik-lib (PyPI). Vendors: Linuxfabrik, PyPI.

Quick answers

Is CVE-2026-73974 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73974 being exploited in the wild.
How severe is CVE-2026-73974?
Medium severity, with a CVSS score of 5.5, published 18 August 2026.
Which products and versions are affected?
Linuxfabrik Monitoring-Plugins all versions using linuxfabrik-lib <= 6.0.0; linuxfabrik-lib (PyPI) < 6.1.0, ECOSYSTEM:introduced=0,fixed=6.1.0.
Is there a fix for CVE-2026-73974?
Yes. linuxfabrik-lib (PyPI): upgrade to 6.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73974 attacked?
It is attacked with local access.
Am I affected by CVE-2026-73974?
Check whether you run Linuxfabrik Monitoring-Plugins or linuxfabrik-lib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • linuxfabrik-lib (PyPI): upgrade to 6.1.0 or later
    pip install "linuxfabrik-lib>=6.1.0"

Technical details

The vulnerability exists in lib.lftest.test() (lftest.py lines 659-664), which unconditionally opens and reads files specified in the first CSV element of the --test argument: `stdout = args[0]; if stdout and os.path.isfile(stdout): _, stdout = disk.read_file(stdout)`. The --test argument is registered with type=lib.args.csv on ~23 whitelisted plugins (e.g., deb-updates, docker-info) and is centrally suppressed from --help but remains accepted on the command line at runtime. No path confinement checks protect the file path. When invoked via sudoers by a nagios/icinga user, plugins execute as root. The deb-updates plugin provides full file disclosure (every line printed); other plugins leak filtered content or act as existence/readability oracles depending on their downstream parsers. An attacker controlling the nagios account can retrieve /etc/shadow, /root/.ssh/id_rsa, TLS certificates, and cloud credentials.

Affected products

  • Linuxfabrik linuxfabrik-lib < 6.1.0
  • Linuxfabrik monitoring-plugins (deb-updates, docker-info, openvpn-client-list, and ~20 others) all versions using linuxfabrik-lib <= 6.0.0

Identifiers

  • CVE-2026-73974
  • GHSA-rh9c-rqvg-f7pr
  • PYSEC-2026-3682

Timeline

  • 2026-07-08: disclosed: Published to GitHub Advisory Database
  • 2026-08-18: advisory: Advisory GHSA-rh9c-rqvg-f7pr and CVE-2026-73974 issued
  • 2026-08-18: patched: linuxfabrik-lib v6.1.0 released with fix (commit d665042)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.