CVE-2026-73974: Linuxfabrik Library Path Traversal Vulnerability

CVE-2026-73974 Overview

CVE-2026-73974 is a path traversal vulnerability [CWE-22] in linuxfabrik-lib, a set of Python modules used by Linuxfabrik Monitoring Plugins for database access, caching, shell execution, and API integrations. The flaw resides in the lib.lftest.test() helper, which treated the first or second element of a --test CSV argument as a filesystem path and returned the file contents as simulated standard output or standard error without path confinement. Because the hidden --test argument was accepted by sudo-authorized plugins, an attacker controlling the nagios or icinga account can disclose the contents of any root-readable file on the host.

Critical Impact
An attacker with access to the monitoring service account can read arbitrary root-readable files, exposing credentials, private keys, and other sensitive configuration data.

Affected Products

linuxfabrik-lib prior to version 6.1.0
Linuxfabrik Monitoring Plugins prior to version 7.0.0
Plugins including check-plugins/deb-updates, check-plugins/network-bonding, and check-plugins/openstack-swift-stat

Discovery Timeline

2026-08-18 - CVE-2026-73974 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-73974

Vulnerability Analysis

The vulnerability stems from the lib.lftest.test() helper in linuxfabrik-lib. The helper accepts a --test CSV argument intended to inject simulated command output during unit testing. Instead of restricting input to fixture files inside the plugin's unit-test directory, the helper interpreted the first or second CSV element as a filesystem path and returned the contents verbatim as standard output or standard error.

Approximately 22 monitoring plugins exposed filtered content or served as a root file existence and readability oracle through this helper. Two additional plugins, check-plugins/network-bonding/network-bonding and check-plugins/openstack-swift-stat/openstack-swift-stat, contained direct read paths that bypassed the helper entirely. The deb-updates plugin with its default QUERY=1 setting could disclose every line of a root-readable file.

Root Cause

The lftest.test() function did not confine fixture reads to the invoking plugin's unit-test directory and did not reject unsafe anchors such as absolute paths or parent-directory references. The --test argument, although hidden, remained production-accessible on plugins granted sudo privileges through the standard Nagios or Icinga integration.

Attack Vector

An attacker with local access to the nagios or icinga service account invokes an affected plugin under sudo and supplies a crafted --test CSV argument pointing at a sensitive file such as /etc/shadow or /root/.ssh/id_rsa. The plugin executes with elevated privileges, reads the target file, and returns its contents in the check output stream. The library patch confines fixture reads to the invoking plugin's unit-test directory and rejects unsafe anchors, as shown below.

python

         path = disk.get_tmpdir()
     if not filename:
         filename = 'linuxfabrik-monitoring-plugins-sqlite.db'
+    # Confine the database to the secured per-user directory: a filename must be
+    # a plain basename. Reject anything that carries a path separator, a
+    # parent-directory reference or an absolute path, so a caller-supplied name
+    # cannot traverse out of the directory get_db_dir() just hardened.
+    if filename in ('.', '..') or os.path.basename(filename) != filename:
+        return False, f'Refusing unsafe database filename: {filename!r}'
     success, db_dir = get_db_dir(path)
     if not success:
         return False, db_dir

Source: Linuxfabrik lib commit d665042

Detection Methods for CVE-2026-73974

Indicators of Compromise

Invocations of monitoring plugins with a --test argument in shell history, sudo logs, or process accounting records.
Unexpected sudo entries under /var/log/auth.log originating from the nagios or icinga user referencing check plugins.
Plugin output containing lines from sensitive files such as /etc/shadow, SSH private keys, or /root/ contents.

Detection Strategies

Audit sudoers entries granting the nagios or icinga user execution rights on Linuxfabrik plugins and correlate with recent invocation logs.
Enable process command-line auditing with auditd rules on the plugin directory to capture --test argument usage.
Search Icinga or Nagios performance data and check history for output containing filesystem paths or file contents outside of expected metric formats.

Monitoring Recommendations

Alert on any execution of Linuxfabrik monitoring plugins that includes the --test command-line flag on production hosts.
Monitor read access to sensitive files such as /etc/shadow, /root/.ssh/, and application secret stores when the requesting process is a monitoring plugin.
Track the installed versions of linuxfabrik-lib and Linuxfabrik Monitoring Plugins across the fleet and flag versions below 6.1.0 and 7.0.0 respectively.

How to Mitigate CVE-2026-73974

Immediate Actions Required

Upgrade linuxfabrik-lib to version 6.1.0 or later and Linuxfabrik Monitoring Plugins to version 7.0.0 or later on all monitored hosts.
Review sudoers configuration for the nagios and icinga accounts and remove blanket privileges that allow unrestricted plugin arguments.
Rotate any credentials, SSH keys, or tokens that reside in root-readable files on hosts running the affected plugins.

Patch Information

The library fix in linuxfabrik-lib v6.1.0 confines fixture reads to the invoking plugin's unit-test directory and refuses unsafe anchors. The companion fix in Linuxfabrik Monitoring Plugins v7.0.0 routes the network-bonding and openstack-swift-stat bypasses through the hardened helper. Full details are available in the GHSA-rh9c-rqvg-f7pr advisory.

Workarounds

Restrict sudo rules so the nagios or icinga account can only execute plugins with a whitelisted argument set that excludes --test.
Deploy a sudo command filter or wrapper script that rejects any invocation containing the --test flag until patches are applied.
Limit interactive access to the nagios and icinga accounts and enforce SSH key or PAM controls to reduce the local attacker surface.

bash

# Configuration example: restrict Nagios sudo invocations to a wrapper
# that strips the --test argument before execution.
nagios ALL=(root) NOPASSWD: /usr/local/bin/lf-plugin-wrapper
# /usr/local/bin/lf-plugin-wrapper rejects '--test' before exec.