CVE-2026-72694: MRTG Privilege Escalation Vulnerability

CVE-2026-72694 Overview

A symbolic link following vulnerability exists in the Multi Router Traffic Grapher (MRTG) daemon. When the daemon starts as root and drops privileges, a local low-privileged attacker can pre-place a symlink at the process ID (PID) file path. The root process then changes ownership of the linked file to the daemon user account. This enables local privilege escalation by granting the attacker write access to sensitive system files. The flaw is tracked as CWE-59: Improper Link Resolution Before File Access.

Critical Impact
A local attacker with low privileges can take ownership of arbitrary files on the host, leading to privilege escalation and unauthorized modification of sensitive system files.

Affected Products

MRTG (Multi Router Traffic Grapher) daemon deployments started as root
Red Hat distributions packaging affected MRTG versions (see Red Hat Advisory)
Linux systems where the MRTG PID file path is writable by non-root users

Discovery Timeline

2026-08-11 - CVE-2026-72694 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-72694

Vulnerability Analysis

MRTG runs as root during initialization to bind privileged resources, then drops to a lower-privileged daemon account. During startup, the daemon writes a PID file to a predictable path. Before dropping privileges, the root process calls chown() on the PID file path to transfer ownership to the daemon user. If the PID file path resolves through a symbolic link, chown() follows the link and modifies the target file's ownership instead.

A local attacker who can write to the directory containing the PID file can pre-place a symlink pointing to any file on the system. When MRTG starts, the root process changes ownership of the linked target to the MRTG daemon account. The attacker, if able to run as or influence that daemon user, then gains write access to the targeted file.

Root Cause

The root cause is the absence of secure file handling primitives when creating or adjusting ownership of the PID file. The code path does not use O_NOFOLLOW, lstat() checks, or fchown() on a securely opened descriptor. This is a classic Time-of-Check to Time-of-Use (TOCTOU) pattern combined with unsafe link resolution, categorized under [CWE-59].

Attack Vector

Exploitation requires local access with low privileges on the host running MRTG. The attacker places a symbolic link at the expected PID file location before the daemon starts or restarts. When MRTG is invoked as root, the ownership change follows the link to an arbitrary target such as /etc/shadow, /etc/passwd, or a systemd unit file. Ownership then transfers to the MRTG daemon user, allowing modification and follow-on privilege escalation.

Vulnerability mechanism (prose description - no verified PoC available):

1. Attacker identifies the MRTG PID file path (e.g., /var/run/mrtg.pid).
2. Attacker creates a symlink at that path targeting a sensitive file.
3. Administrator or init system starts the MRTG daemon as root.
4. Root process performs chown() on the PID path, following the symlink.
5. Ownership of the sensitive target file transfers to the MRTG daemon user.
6. Attacker leverages daemon-user write access for privilege escalation.

See the Red Hat advisory for authoritative technical details.

Detection Methods for CVE-2026-72694

Indicators of Compromise

Symbolic links present in /var/run, /run, or other PID file directories that point to sensitive system files such as /etc/shadow, /etc/passwd, or cron directories.
Unexpected ownership changes on system files, where the new owner matches the MRTG daemon service account.
Audit log entries showing chown() syscalls executed by the MRTG process against paths outside its normal working directory.

Detection Strategies

Deploy file integrity monitoring across /etc, /var/spool/cron, and /usr/lib/systemd to detect unauthorized ownership transitions.
Enable Linux audit rules (auditd) to log all chown, fchownat, and lchown syscalls originating from the MRTG process.
Correlate MRTG service start events with subsequent file ownership changes to identify successful symlink exploitation.

Monitoring Recommendations

Alert on creation of symbolic links in PID file directories by non-root users, particularly links pointing outside those directories.
Track MRTG daemon restarts and cross-reference them with file ownership modification events within a short time window.
Review shell history and process execution logs for ln -s commands referencing PID file paths.

How to Mitigate CVE-2026-72694

Immediate Actions Required

Apply the vendor-supplied MRTG package update as soon as it is available from your Linux distribution.
Audit PID file directories for pre-placed symbolic links and remove any that point outside the intended path.
Restrict write access to PID file directories so only trusted system accounts can create files there.

Patch Information

Refer to the Red Hat CVE-2026-72694 Advisory and Red Hat Bug Report #2460973 for package updates and errata. Apply distribution updates through your standard package manager (yum update mrtg, dnf update mrtg, or apt-get upgrade mrtg) once fixed versions are published.

Workarounds

Configure MRTG to write its PID file to a directory writable only by root, such as a dedicated subdirectory under /run owned by root with mode 0755.
Run MRTG under a dedicated service account from the outset using systemd User= directives, avoiding the root-to-daemon privilege drop pattern where feasible.
Enable filesystem protections such as fs.protected_symlinks=1 and fs.protected_hardlinks=1 in sysctl to limit symlink exploitation in world-writable directories.

bash

# Configuration example: harden symlink handling and PID file location
sudo sysctl -w fs.protected_symlinks=1
sudo sysctl -w fs.protected_hardlinks=1
echo 'fs.protected_symlinks=1' | sudo tee -a /etc/sysctl.d/90-mrtg-hardening.conf
echo 'fs.protected_hardlinks=1' | sudo tee -a /etc/sysctl.d/90-mrtg-hardening.conf

# Create a root-owned PID directory for MRTG
sudo install -d -o root -g root -m 0755 /run/mrtg
# Update MRTG configuration to place the PID file here:
#   PIDFile: /run/mrtg/mrtg.pid

# Audit rule to log chown activity by MRTG
sudo auditctl -a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F key=mrtg-chown