Description

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test() treated the first or second element of a --test CSV argument as a filesystem path and returned the file contents as simulated standard output or standard error without path confinement. The hidden but production-accessible --test argument was accepted by sudo-authorized plugins, so an attacker controlling the nagios or icinga account could use check-plugins/deb-updates/deb-updates with its default QUERY=1 to disclose every line of a root-readable file. Approximately 22 other plugins exposed filtered content or a root file existence and readability oracle through the same helper, while check-plugins/network-bonding/network-bonding and check-plugins/openstack-swift-stat/openstack-swift-stat had direct read paths that bypassed the helper. The library fix confines fixture reads to the invoking plugin's unit-test directory and refuses unsafe anchors, and the plugin fix routes the two bypasses through that helper. These issues are fixed in linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-18T22:17:33.840Z",
  "pubdate": "2026-08-18T22:17:33.840Z",
  "executiveSummary": "An arbitrary file disclosure vulnerability exists in linuxfabrik-lib prior to version 6.1.0 and Linuxfabrik Monitoring Plugins prior to version 7.0.0.\nThe vulnerability stems from an insecure testing helper function, lib.lftest.test(), which processes a hidden and production-accessible --test command-line argument without proper path confinement.\nAn attacker who controls the nagios or icinga account and has sudo privileges can exploit this flaw to read arbitrary root-readable files on the underlying filesystem.\nThe impact includes the unauthorized disclosure of sensitive system configuration files, filtered content exposure, and root file existence/readability oracles.\nExploitation requires local access to specific privileged monitoring plugin execution paths, such as check-plugins/deb-updates/deb-updates, check-plugins/network-bonding/network-bonding, and check-plugins/openstack-swift-stat/openstack-swift-stat.\nThe risk is mitigated by updating the affected software packages to the patched versions, which enforce path confinement within the invoking plugin's unit-test directory and reject unsafe anchors.",
  "technicalDetails": "The root cause of the vulnerability resides in the shared testing helper function lib.lftest.test() within linuxfabrik-lib. Prior to version 6.1.0, this function accepted a --test CSV argument via command-line inputs and treated the first or second element as a filesystem path without enforcing path confinement restrictions.\nThe function then returned the target file contents as simulated standard output or standard error. Because the hidden --test argument was accessible in production environments and accepted by sudo-authorized plugins, execution paths were exposed to lower-privileged monitoring accounts.\nSpecifically, an attacker controlling the nagios or icinga account could leverage check-plugins/deb-updates/deb-updates with its default QUERY=1 parameter to disclose every single line of any root-readable file on the system.\nAdditionally, approximately 22 other plugins exposed filtered content or functioned as a root file existence and readability oracle through the same vulnerable helper mechanism. Furthermore, check-plugins/network-bonding/network-bonding and check-plugins/openstack-swift-stat/openstack-swift-stat implemented direct read paths that entirely bypassed the helper function.\nThe attack flow proceeds as follows: 1) The attacker authenticates or executes code within the context of the nagios or icinga user account; 2) The attacker invokes a sudo-authorized monitoring plugin, such as check-plugins/deb-updates/deb-updates, appending the malicious --test argument containing the absolute or relative path to a sensitive root-readable file; 3) The vulnerable lib.lftest.test() function parses the CSV input, treats the specified path without confinement checks, and reads the file contents; 4) The plugin outputs the file contents within the standard output or standard error stream, successfully disclosing sensitive data to the unauthorized user.\nThe vulnerable components include linuxfabrik-lib prior to 6.1.0 and Linuxfabrik Monitoring Plugins prior to 7.0.0. Authentication and privilege requirements include local access to the nagios or icinga user accounts alongside sudo authorization to execute the affected monitoring check plugins."
}