Riskcovery

CVE-2026-67433

Linuxfabrik monitoring-plugins: Symlink following in logfile legacy database migration

State
Published
Severity
5.8 Medium
Published
Jul 29, 2026
Updated
Jul 30, 2026
Reserved
Jul 29, 2026

Read the record on cve.org

Description

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename() and allowed a local user controlling the plugin account to place a symlink that would be followed by sqlite3.connect() during a root-run check.

Scores

CVSSScoreVectorSource
4.05.8 MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:NGitHub_M

Weaknesses

  • CWE-59 Improper Link Resolution Before File Access ('Link Following')
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

Affected Products

ProductVersions
monitoring-pluginsLinuxfabrik
  • 6.0.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.