CVE-2026-67436: Linuxfabrik Monitoring Plugins Disclosure

CVE-2026-67436 Overview

CVE-2026-67436 affects Linuxfabrik monitoring-plugins, a suite of Python monitoring plugins for Icinga, Nagios, and related monitoring systems. Versions 6.0.0 and earlier contain a flaw in the redfish-* plugins. The plugins construct request URLs by concatenating an operator-supplied base URL with @odata.id links returned in Redfish API responses. A malicious or compromised Baseboard Management Controller (BMC) can return crafted @odata.id values that redirect authenticated Redfish requests to an attacker-controlled host. Because the plugins reuse the same authentication material across requests, this behavior can disclose X-Auth-Token session tokens or HTTP Basic credentials to the attacker.

Critical Impact
A compromised BMC can steal Redfish authentication tokens or Basic credentials from monitoring hosts, enabling lateral access to server management interfaces.

Affected Products

Linuxfabrik monitoring-plugins version 6.0.0 and earlier
All redfish-* check plugins including redfish-ethernetinterfaces and redfish-firmwareinventory
Icinga, Nagios, and compatible monitoring systems using these plugins

Discovery Timeline

2026-07-29 - CVE-2026-67436 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-67436

Vulnerability Analysis

The Redfish protocol uses @odata.id fields to reference related resources within a management API response. The Linuxfabrik redfish-* plugins follow these references by concatenating the operator-supplied base URL with the response-supplied @odata.id value. The plugins do not validate that the resulting URL remains within the intended Redfish endpoint. This weakness is classified as improper input validation [CWE-20].

When the plugin issues follow-up requests, it attaches the caller's authentication material, either an X-Auth-Token header or HTTP Basic credentials. A BMC that returns an absolute URL or a path that resolves outside the trusted host causes the plugin to send those credentials to an attacker-controlled destination.

Root Cause

The root cause is trusting untrusted response data to construct authenticated outbound requests. The plugins should treat @odata.id values as opaque paths that must resolve within the configured Redfish base URL host, but instead accept arbitrary references. This pattern combines Server-Side Request Forgery (SSRF) with credential leakage.

Attack Vector

An attacker who controls or compromises a BMC targeted by the monitoring host returns a malicious @odata.id value pointing to a host they control. The monitoring plugin, running with its stored operator credentials, issues an authenticated request to the attacker's endpoint. The attacker captures the X-Auth-Token or Basic authentication header and can replay it against legitimate Redfish endpoints or against the monitoring host itself.

text

// Security patch metadata from upstream commit
 from lib.globals import STATE_CRIT, STATE_OK, STATE_UNKNOWN, STATE_WARN

 __author__ = 'Linuxfabrik GmbH, Zurich/Switzerland'
-__version__ = '2026060706'
+__version__ = '2026070701'

 DESCRIPTION = """Checks the state of all Ethernet interfaces in a Redfish-compatible
 server via the Redfish API. Alerts when any enabled Ethernet interface reports
 a degraded or failed health state.

Source: GitHub Commit ffb0a81. The patch introduces @odata.id validation across all redfish-* plugins, including redfish-ethernetinterfaces and redfish-firmwareinventory, to prevent SSRF and token leakage.

Detection Methods for CVE-2026-67436

Indicators of Compromise

Outbound HTTPS requests from monitoring hosts to unexpected destinations, especially destinations outside the documented BMC address ranges.
Redfish requests originating from monitoring plugin hosts that contain X-Auth-Token or Authorization: Basic headers directed at non-BMC hosts.
Anomalous @odata.id response values from BMCs containing absolute URLs or path traversal sequences.

Detection Strategies

Inspect proxy or firewall logs for outbound connections from Icinga or Nagios hosts to any IP not in the approved BMC inventory.
Audit Redfish session logs on BMCs for tokens issued to the monitoring host that were subsequently used from unexpected source IPs.
Review installed versions of Linuxfabrik monitoring-plugins and flag hosts running 6.0.0 or earlier.

Monitoring Recommendations

Egress-filter monitoring servers so they can only reach the defined BMC management subnet.
Alert on any Redfish authentication token used from more than one source IP within a short time window.
Track version drift on monitoring plugin hosts and confirm upgrades to fixed releases.

How to Mitigate CVE-2026-67436

Immediate Actions Required

Upgrade Linuxfabrik monitoring-plugins to the release containing commit ffb0a81 (plugin version 2026070701 or later).
Rotate any Redfish credentials and API tokens used by the monitoring host, since they may already be exposed.
Restrict outbound network access from monitoring hosts to the approved BMC management network only.

Patch Information

The fix is committed in Linuxfabrik monitoring-plugins commit ffb0a81 and described in GitHub Security Advisory GHSA-96fx-pqc3-28xv. The patch validates @odata.id links before dispatching authenticated Redfish requests, preventing token disclosure to unintended hosts.

Workarounds

Isolate monitoring hosts on a dedicated network segment with strict egress rules limiting traffic to known BMC IP addresses.
Use short-lived Redfish session tokens rather than long-lived HTTP Basic credentials wherever supported.
Disable or unschedule the affected redfish-* plugins until the fixed version is deployed.

bash

# Example egress restriction using iptables on a monitoring host
# Allow HTTPS only to the BMC management subnet 10.20.30.0/24
iptables -A OUTPUT -p tcp --dport 443 -d 10.20.30.0/24 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j REJECT