CVE-2026-73973: Monitoring Plugins Path Traversal Flaw

CVE-2026-73973 Overview

CVE-2026-73973 is a path traversal vulnerability [CWE-22] in Linuxfabrik Monitoring Plugins, a suite that provides monitoring plugins for Icinga, Nagios, and related systems. Versions prior to 7.0.0 shipped a check-plugins/logfile/logfile script that accepted a free-form --filename argument and opened the path as root when invoked through the bundled nagios or icinga sudoers allowlist. The script did not confine the resolved path to /var/log. An attacker who controls the monitoring account can read arbitrary root-owned files, including /etc/shadow, by combining --filename with regex-matching flags.

Critical Impact
A local attacker with access to the monitoring user account can read arbitrary files as root, disclosing credentials, keys, and other sensitive host data.

Affected Products

Linuxfabrik Monitoring Plugins versions prior to 7.0.0
check-plugins/logfile/logfile
check-plugins/mysql-logfile/mysql-logfile and check-plugins/openvpn-client-list (same containment fix)

Discovery Timeline

2026-08-14 - Linuxfabrik releases Monitoring Plugins v7.0.0 with the containment fix
2026-08-18 - CVE-2026-73973 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-73973

Vulnerability Analysis

The logfile plugin scans log files for matching patterns and returns matches through the standard Nagios/Icinga output pipeline. Because operators need root to read certain logs, distributors ship a sudoers allowlist that lets the nagios or icinga account invoke the plugin as root. The plugin accepts a --filename parameter and passes the expanded scan_path directly to Python's open(). Neither real-path resolution nor an allowlist restricts the sink to /var/log.

An attacker supplies --filename /etc/shadow together with --warning-regex . and leaves SUPPRESS_OUTPUT at its default false value. Each nonempty line is appended to warn_matches and returned through lib.base.oao() in the plugin's warning output, leaking the entire file contents to the monitoring user.

Root Cause

The root cause is missing path containment on a sudo-privileged sink. The plugin trusted the caller-supplied filename and never resolved symlinks or parent-directory traversal (..) before opening the file. The mysql-logfile and openvpn-client-list plugins had the same class of flaw.

Attack Vector

Exploitation requires local access to a host that grants the nagios or icinga account the shipped sudoers rule. The attacker invokes the plugin under sudo with a target path such as /etc/shadow, /root/.ssh/id_rsa, or a container secret file, and reads matched lines from the plugin's warning output.

text

// Patch excerpt from check-plugins/logfile/logfile (v7.0.0)
 import lib.args
 import lib.base
 import lib.db_sqlite
+import lib.disk
 import lib.icinga
 import lib.time
 import lib.txt
 from lib.globals import STATE_CRIT, STATE_OK, STATE_UNKNOWN, STATE_WARN

 __author__ = 'Linuxfabrik GmbH, Zurich/Switzerland'
-__version__ = '2026070701'
+__version__ = '2026070801'

Source: Linuxfabrik Monitoring Plugins commit a0ca126

Detection Methods for CVE-2026-73973

Indicators of Compromise

Sudo audit entries showing the nagios or icinga account invoking logfile, mysql-logfile, or openvpn-client-list with a --filename value outside /var/log.
Plugin output or Icinga/Nagios history containing lines that match the format of /etc/shadow, SSH private keys, or other sensitive files.
Repeated plugin executions using --warning-regex . or similar catch-all regex patterns.

Detection Strategies

Alert on any sudo execution of the affected plugins where the argument list contains paths outside documented log roots.
Correlate monitoring-user shell activity with sudo invocations to identify interactive misuse of the plugin binary.
Review Icinga/Nagios check history for output that resembles file contents rather than log line counts.

Monitoring Recommendations

Enable auditd rules on /usr/lib/nagios/plugins/logfile and related plugin paths to log every execve with full argument capture.
Ship sudo logs and plugin stdout to a central log store and search for suspicious --filename values.
Baseline expected monitoring plugin invocations so unusual filename arguments stand out.

How to Mitigate CVE-2026-73973

Immediate Actions Required

Upgrade Linuxfabrik Monitoring Plugins to version 7.0.0 or later on all monitored hosts.
Rotate any credentials that could have been exposed if the nagios or icinga account is suspected of misuse, including /etc/shadow hashes and SSH keys.
Restrict interactive shell access to the monitoring service accounts.

Patch Information

The fix is included in Linuxfabrik Monitoring Plugins v7.0.0, released 2026-08-14. The patched plugins import lib.disk, resolve symlinks and .. traversal, and enforce an allowlist of documented log roots before opening files. See the security advisory GHSA-f54c-p5vg-mr5c and the v7.0.0 changelog for full details.

Workarounds

Remove or tighten the shipped nagios or icinga sudoers entries so the plugins cannot be invoked as root until upgrading.
Wrap the plugin in a controlled script that validates --filename against /var/log before calling the real binary.
Constrain plugin invocation with Cmnd_Alias sudo rules that pin the allowed filename argument.

bash

# Restrict the sudoers allowlist to a fixed filename until v7.0.0 is deployed
Cmnd_Alias LFK_LOGFILE = /usr/lib/nagios/plugins/logfile --filename /var/log/syslog *
nagios ALL=(root) NOPASSWD: LFK_LOGFILE