# CVE-2026-73974: Linuxfabrik monitoring-plugins arbitrary root file read via --test argument

Source: https://junglewise.ai/threats/cve-2026-73974-linuxfabrik-monitoring-plugins-arbitrary-root-file-read-via-test  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73974 · Severity: medium · CVSS 5.5 · Published 2026-08-18

Linuxfabrik's monitoring plugins (used to gather system and application health data in Nagios/Icinga environments) contain a hidden --test argument that allows reading arbitrary files on disk when the plugin runs as root. An attacker with access to the unprivileged nagios or icinga account can abuse sudoers-whitelisted plugins to retrieve sensitive files like password databases and encryption keys, leading to full system compromise.

Technologies: [Linuxfabrik Monitoring-Plugins](https://junglewise.ai/threats/technologies/monitoring-plugins), [linuxfabrik-lib (PyPI)](https://junglewise.ai/threats/technologies/linuxfabrik-lib). Vendors: [Linuxfabrik](https://junglewise.ai/threats/vendors/linuxfabrik), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-73974 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73974 being exploited in the wild.

**How severe is CVE-2026-73974?** Medium severity, with a CVSS score of 5.5, published 18 August 2026.

**Which products and versions are affected?** Linuxfabrik Monitoring-Plugins all versions using linuxfabrik-lib <= 6.0.0; linuxfabrik-lib (PyPI) < 6.1.0, ECOSYSTEM:introduced=0,fixed=6.1.0.

**Is there a fix for CVE-2026-73974?** Yes. linuxfabrik-lib (PyPI): upgrade to 6.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73974 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-73974?** Check whether you run Linuxfabrik Monitoring-Plugins or linuxfabrik-lib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- linuxfabrik-lib (PyPI): upgrade to 6.1.0 or later

  ```sh
  pip install "linuxfabrik-lib>=6.1.0"
  ```


## Technical details

The vulnerability exists in lib.lftest.test() (lftest.py lines 659-664), which unconditionally opens and reads files specified in the first CSV element of the --test argument: `stdout = args[0]; if stdout and os.path.isfile(stdout): _, stdout = disk.read_file(stdout)`. The --test argument is registered with type=lib.args.csv on ~23 whitelisted plugins (e.g., deb-updates, docker-info) and is centrally suppressed from --help but remains accepted on the command line at runtime. No path confinement checks protect the file path. When invoked via sudoers by a nagios/icinga user, plugins execute as root. The deb-updates plugin provides full file disclosure (every line printed); other plugins leak filtered content or act as existence/readability oracles depending on their downstream parsers. An attacker controlling the nagios account can retrieve /etc/shadow, /root/.ssh/id_rsa, TLS certificates, and cloud credentials.

## Affected products

- Linuxfabrik linuxfabrik-lib < 6.1.0
- Linuxfabrik monitoring-plugins (deb-updates, docker-info, openvpn-client-list, and ~20 others) all versions using linuxfabrik-lib <= 6.0.0

## Identifiers

- CVE-2026-73974
- GHSA-rh9c-rqvg-f7pr
- PYSEC-2026-3682

## Timeline

- 2026-07-08: disclosed: Published to GitHub Advisory Database
- 2026-08-18: advisory: Advisory GHSA-rh9c-rqvg-f7pr and CVE-2026-73974 issued
- 2026-08-18: patched: linuxfabrik-lib v6.1.0 released with fix (commit d665042)

## References

- [https://api.github.com/users/manus-use](https://api.github.com/users/manus-use)
- [https://github.com/manus-use](https://github.com/manus-use)
- [https://api.github.com/users/manus-use/gists%7B/gist_id%7D](https://api.github.com/users/manus-use/gists%7B/gist_id%7D)
- [https://api.github.com/users/manus-use/repos](https://api.github.com/users/manus-use/repos)
- [https://avatars.githubusercontent.com/u/213290975?v=4](https://avatars.githubusercontent.com/u/213290975?v=4)
- [https://api.github.com/users/manus-use/events%7B/privacy%7D](https://api.github.com/users/manus-use/events%7B/privacy%7D)

## Related threats

- [Linuxfabrik Monitoring Plugins insecure temporary file creation in linuxfabrik-lib](https://junglewise.ai/threats/cve-2026-53759-linuxfabrik-monitoring-plugins-insecure-temporary-file-creation)
- [Linuxfabrik monitoring-plugins SSRF and credential disclosure in redfish plugins](https://junglewise.ai/threats/cve-2026-67436-linuxfabrik-monitoring-plugins-ssrf-and-credential-disclosure-in)
- [Linuxfabrik linuxfabrik-lib sensitive header exposure in fetch redirect](https://junglewise.ai/threats/cve-2026-67435-linuxfabrik-linuxfabrik-lib-sensitive-header-exposure-in-fetch)
- [Linuxfabrik monitoring-plugins symlink following in logfile migration](https://junglewise.ai/threats/cve-2026-67433-linuxfabrik-monitoring-plugins-symlink-following-in-logfile)
- [Linuxfabrik Monitoring Plugins OS command injection in shell_exec](https://junglewise.ai/threats/cve-2026-55426-linuxfabrik-monitoring-plugins-os-command-injection-in-shell-exec)