CVE-2026-55426 (GCVE-0-2026-55426)
Vulnerability from cvelistv5
Published
2026-08-18 20:57
Modified
2026-08-20 18:26
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Summary
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The shared library also accepted command strings and a shell parameter, while numerous plugins constructed external commands from attacker-influenced arguments. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linuxfabrik | monitoring-plugins |
Version: < 6.0.0 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55426",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T20:31:18.922121Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:26:01.989Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "monitoring-plugins",
"vendor": "Linuxfabrik",
"versions": [
{
"status": "affected",
"version": "\u003c 6.0.0"
}
]
},
{
"product": "lib",
"vendor": "Linuxfabrik",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The shared library also accepted command strings and a shell parameter, while numerous plugins constructed external commands from attacker-influenced arguments. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T20:57:59.873Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-798h-hpph-m24j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-798h-hpph-m24j"
},
{
"name": "https://github.com/Linuxfabrik/monitoring-plugins/commit/23bb570f41fc8d9caf30b30074bba0e3db1b357a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Linuxfabrik/monitoring-plugins/commit/23bb570f41fc8d9caf30b30074bba0e3db1b357a"
},
{
"name": "https://github.com/Linuxfabrik/lib/blob/main/CHANGELOG.md",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Linuxfabrik/lib/blob/main/CHANGELOG.md"
},
{
"name": "https://github.com/Linuxfabrik/lib/releases/tag/v5.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Linuxfabrik/lib/releases/tag/v5.0.0"
},
{
"name": "https://github.com/Linuxfabrik/monitoring-plugins/blob/main/CHANGELOG.md",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Linuxfabrik/monitoring-plugins/blob/main/CHANGELOG.md"
},
{
"name": "https://github.com/Linuxfabrik/monitoring-plugins/releases/tag/v6.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Linuxfabrik/monitoring-plugins/releases/tag/v6.0.0"
}
],
"source": {
"advisory": "GHSA-798h-hpph-m24j",
"discovery": "UNKNOWN"
},
"title": "linuxfabrik-lib: Local privilege escalation using embedded command"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55426",
"datePublished": "2026-08-18T20:57:59.873Z",
"dateReserved": "2026-06-16T21:48:43.126Z",
"dateUpdated": "2026-08-20T18:26:01.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-55426\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-19T20:31:18.922121Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-20T18:25:59.288Z\"}}], \"cna\": {\"title\": \"linuxfabrik-lib: Local privilege escalation using embedded command\", \"source\": {\"advisory\": \"GHSA-798h-hpph-m24j\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Linuxfabrik\", \"product\": \"monitoring-plugins\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 6.0.0\"}]}, {\"vendor\": \"Linuxfabrik\", \"product\": \"lib\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 5.0.0\"}]}], \"references\": [{\"url\": \"https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-798h-hpph-m24j\", \"name\": \"https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-798h-hpph-m24j\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/Linuxfabrik/monitoring-plugins/commit/23bb570f41fc8d9caf30b30074bba0e3db1b357a\", \"name\": \"https://github.com/Linuxfabrik/monitoring-plugins/commit/23bb570f41fc8d9caf30b30074bba0e3db1b357a\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Linuxfabrik/lib/blob/main/CHANGELOG.md\", \"name\": \"https://github.com/Linuxfabrik/lib/blob/main/CHANGELOG.md\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Linuxfabrik/lib/releases/tag/v5.0.0\", \"name\": \"https://github.com/Linuxfabrik/lib/releases/tag/v5.0.0\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Linuxfabrik/monitoring-plugins/blob/main/CHANGELOG.md\", \"name\": \"https://github.com/Linuxfabrik/monitoring-plugins/blob/main/CHANGELOG.md\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Linuxfabrik/monitoring-plugins/releases/tag/v6.0.0\", \"name\": \"https://github.com/Linuxfabrik/monitoring-plugins/releases/tag/v6.0.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The shared library also accepted command strings and a shell parameter, while numerous plugins constructed external commands from attacker-influenced arguments. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-18T20:57:59.873Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-55426\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-20T18:26:01.989Z\", \"dateReserved\": \"2026-06-16T21:48:43.126Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-18T20:57:59.873Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…