Log in Start free

Vulnerability · Published Aug 11, 2026 · Assigned by redhat

CVE-2026-72694Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation

High 7.1

In plain English

A high-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.1%top 96.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10mrtg2.17.10-12.el10_2.1ALSA-2026:57596
AlmaLinux:8mrtg2.17.7-1.el8_10.1ALSA-2026:65832
AlmaLinux:9mrtg2.17.7-12.el9_8.1ALSA-2026:57600
AlmaLinux:10mrtg-selinux2.17.10-12.el10_2.1ALSA-2026:57596
Debian:12mrtgno fix listedDEBIAN-CVE-2026-72694
Debian:13mrtg2.17.10-13+deb13u2DEBIAN-CVE-2026-72694
Debian:14mrtg2.17.10-15DEBIAN-CVE-2026-72694
Rocky Linux:10mrtg0:2.17.10-12.el10_2.1RLSA-2026:57596
Rocky Linux:8mrtg0:2.17.7-1.el8_10.1RLSA-2026:65832
Rocky Linux:9mrtg0:2.17.7-12.el9_8.1RLSA-2026:57600
Ubuntu:22.04:LTSmrtgno fix listedUBUNTU-CVE-2026-72694
Ubuntu:24.04:LTSmrtgno fix listedUBUNTU-CVE-2026-72694
Ubuntu:26.04:LTSmrtgno fix listedUBUNTU-CVE-2026-72694
Ubuntu:26.10mrtgno fix listedUBUNTU-CVE-2026-72694

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references

Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References