{"items":[{"id":"NVI-00017858","kind":"vulnerability","title":"Linuxfabrik Monitoring Plugins have local privilege escalation using embedded command","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-798h-hpph-m24j","CVE-2026-55426"],"plain_summary":"GitHub lists this reviewed advisory for linuxfabrik-lib. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-742efba2f48d779d9cecac0d02e58eea"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-06T21:13:39.000Z","value":"7.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-742efba2f48d779d9cecac0d02e58eea"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-742efba2f48d779d9cecac0d02e58eea","url":"https://github.com/advisories/GHSA-798h-hpph-m24j","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-798h-hpph-m24j","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T23:36:01.427Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-742efba2f48d779d9cecac0d02e58eea"],"technology":"linuxfabrik-lib","known_exclusions":[],"conditions_summary":"### Summary\nWhen a check plugin places user provided input inside a command which is passed to `shell_exec`, an attacker can abuse this to run arbitrary commands. This is mainly dangerous for plugins which are listed in the sudoers file, because this allows an attacker controlling the nagios user to get root privileges.\n\n### Details\nAn example for this is the `restic-check` plugin, where the `--repo` argument is placed inside the command argument of `shell_exec`. As an example, an attacker could use the `--repo` argument `|touch /root/nagios-was-here|`. The full restic command is assembled to the string `restic --json --repo=|touch /root/nagios-was-here| --password-file= check` before it is passed to `shell_exec`. `shell_exec` then splits the command up in three parts at the | boundaries and executes the parts separately, which also executes the embedded command `touch /root/nagios-was-here`.\n\n### PoC\nThis PoC shows how the nagios user can use this to create a file inside `/root`.\n```\nnagios@test-vm:/$ sudo /usr/lib64/nagios/plugins/restic-check --repo '|touch /root/nagios-was-here|'\n```\n\n### Impact\nThe vulnerability is a local privilege escalation.\n\n### Fix\n\n#### Switch from | to ","public_affected_ranges":["< 5.0.0"]}],"null_published_at":"2026-11-05T19:10:21.476Z","source_updated_at":"2026-07-06T21:13:39.000Z","source_disclosed_at":"2026-07-06T21:13:38.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T23:36:01.427Z"}],"next_cursor":null,"snapshot_revision":"42594"}