CVE-2026-67433

Received Received - Intake

Linuxfabrik monitoring-plugins Local Privilege Escalation via Symlink

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename() and allowed a local user controlling the plugin account to place a symlink that would be followed by sqlite3.connect() during a root-run check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-67433

Affected Vendors & Products

Vendor	Product	Version / Range
linuxfabrik	monitoring-plugins	6.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Linuxfabrik monitoring-plugins version 6.0.0. It involves a predictable path in the logfile check legacy database migration that uses os.rename(). A local user with control over the plugin account can create a symlink at this path. When a root-run check executes sqlite3.connect(), it follows the symlink, potentially leading to unauthorized access or manipulation of files.

Detection Guidance

Check for unusual symlink activity in /tmp related to the monitoring-plugins logfile check. Review system logs for unexpected root-run checks or sqlite3.connect() operations originating from the plugin account.

Impact Analysis

If exploited, this vulnerability could allow a local attacker to escalate privileges by manipulating files accessed by root-run checks. This might result in unauthorized data access, modification, or denial of service on the affected monitoring system.

Mitigation Strategies

Upgrade to a patched version of Linuxfabrik monitoring-plugins if available. Restrict write permissions to /tmp for the plugin account. Monitor for suspicious symlink creation or unexpected root processes spawned by the plugin.

Hi! I’m here to help you understand CVE-2026-67433. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70