Vulnerability · Published Jul 29, 2026 · Assigned by GitHub_M

CVE-2026-67433Linuxfabrik monitoring-plugins: Symlink following in logfile legacy database migration

Medium 5.8

In plain English

A medium-severity security flaw in monitoring-plugins from Linuxfabrik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 4.0)5.8Medium

Exploit odds (30 days)0.1%top 98.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename() and allowed a local user controlling the plugin account to place a symlink that would be followed by sqlite3.connect() during a root-run check.

Affected products (as reported)

Vendor	Product	Versions
Linuxfabrik	monitoring-plugins	6.0.0

Weakness: CWE-59, CWE-367 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

References

https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-w2gg-hx6w-24w3 x_refsource_CONFIRM
https://github.com/Linuxfabrik/monitoring-plugins/commit/6df1f574aa9dc6541e092f1ce482ecc1315cded0 x_refsource_MISC