CVE-2026-55426

Received Received - Intake

Command Injection in Linuxfabrik-lib and Monitoring Plugins

Publication date: 2026-08-18

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The shared library also accepted command strings and a shell parameter, while numerous plugins constructed external commands from attacker-influenced arguments. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-20

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-55426

Affected Vendors & Products

Vendor	Product	Version / Range
linuxfabrik	linuxfabrik_lib	to 5.0.0 (inc)
linuxfabrik	linuxfabrik_monitoring_plugins	to 6.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability involves command injection in linuxfabrik-lib and Linuxfabrik Monitoring Plugins. User-controlled values in command strings were embedded without proper sanitization, allowing attackers to inject commands via pipe characters. This could lead to arbitrary command execution, especially when combined with sudo privileges, enabling privilege escalation to root.

Detection Guidance

This vulnerability involves command injection via pipe characters in user-controlled inputs passed to shell_exec(). To detect it, inspect Python scripts using linuxfabrik-lib or Linuxfabrik Monitoring Plugins for unsafe shell command constructions, particularly in restic-check plugins or similar components. Look for string splitting at pipe characters or direct shell=True usage in command execution.

Impact Analysis

If exploited, this vulnerability could allow an attacker with access to a monitoring account to execute arbitrary commands on the system. This may lead to unauthorized data access, system compromise, or further lateral movement within the network. The impact is higher if the monitoring account has sudo privileges.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential exposure of sensitive data.

Mitigation Strategies

Upgrade to linuxfabrik-lib 5.0.0 or later and Linuxfabrik Monitoring Plugins 6.0.0 or later to address the root cause. Ensure all plugins use argv lists with shell=False and avoid pipe splitting. Validate and sanitize all user inputs using lib.shell.safe_cli_value() to prevent command injection.

Hi! I’m here to help you understand CVE-2026-55426. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70