Root Access Vulnerability in Linuxfabrik Monitoring Plugins for Nagios and Icinga

CVE-2026-73973

What is CVE-2026-73973?

The Linuxfabrik Monitoring Plugins, designed for Icinga and Nagios environments, contained a vulnerability prior to version 7.0.0 in the check-plugins/logfile/logfile functionality. This vulnerability allowed an attacker who gained control over the monitoring account to exploit the --filename path parameter, potentially opening sensitive files that are readable by the root user, such as /etc/shadow. The attack could be executed without adequate path containment measures, as the application directly passed the resolved file path to the open() function, exposing it to arbitrary file reading risks. In version 7.0.0, safeguards were implemented to restrict log file paths, preventing unauthorized access to non-documented log roots and enforcing proper symlink resolution and parent-directory traversal checks.

References