CVE-2026-67436

Awaiting Analysis Awaiting Analysis - Queue

Redfish Credential Disclosure in Linuxfabrik monitoring-plugins

Publication date: 2026-07-29

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish-* plugins built request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, allowing a malicious or compromised BMC to redirect authenticated Redfish requests and disclose X-Auth-Token or HTTP Basic credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-30

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-67436

Affected Vendors & Products

Vendor	Product	Version / Range
linuxfabrik	monitoring_plugins	to 6.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability affects Linuxfabrik monitoring-plugins, specifically versions 6.0.0 and earlier. The redfish-* plugins construct request URLs by combining a user-provided base URL with @odata.id links from responses. A malicious or compromised BMC (Baseboard Management Controller) can exploit this to redirect authenticated Redfish requests, potentially exposing sensitive credentials like X-Auth-Token or HTTP Basic authentication details.

Detection Guidance

This vulnerability involves redfish-* plugins in Linuxfabrik monitoring-plugins versions 6.0.0 and earlier. Detection requires checking plugin versions and monitoring for unusual Redfish API requests or credential disclosures. No specific commands are provided in the context.

Impact Analysis

If you use the affected Linuxfabrik monitoring-plugins with Redfish-enabled systems, an attacker could intercept or redirect requests to steal authentication credentials. This may lead to unauthorized access to your monitoring infrastructure or the systems being monitored, compromising data integrity and confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements under GDPR and HIPAA. If credentials are exposed, it may result in non-compliance with data protection and security standards, potentially leading to legal and financial penalties.

Mitigation Strategies

Upgrade to a version of Linuxfabrik monitoring-plugins later than 6.0.0 to fix the issue. Review all redfish-* plugin configurations to ensure they do not rely on untrusted @odata.id links. Monitor BMC communications for unusual redirection or credential exposure.

Hi! I’m here to help you understand CVE-2026-67436. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70