CVE-2026-103431: Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape sequences in data received from remote collectl instances

Q: Who is exposed to this issue in practice?

Operators who use colmux to view monitoring data from remote collectl instances are exposed, particularly when any monitored host permits an unprivileged local user to control process names. The default systemd deployment commonly runs collectl as root, so process-name data from such users can be forwarded to colmux.

Q: What does an attacker need to exploit it?

An attacker needs unprivileged local access on a host monitored by collectl and must be able to cause an operator to view the host's data through colmux. Exploitation relies on embedding ANSI/VT100 escape sequences in a process name, such as argv[0].

Q: Are default configurations affected?

The upstream fix uses a sanitizer that is enabled by default; prior behavior rendered received data directly in the operator's terminal. The described systemd unit has no User= directive, so collectl commonly runs as root.

Q: What can be done if updating is not immediately possible?

Avoid using colmux to display data from untrusted or potentially user-controlled monitored hosts, and treat terminal output from those hosts as untrusted. Do not enable the --rawescape opt-out except on trusted networks.

Q: How can I determine whether a fix is available?

Upstream fixed the issue in collectl 4.3.20.2 and 4.3.20.3. Fedora shipped the fix in collectl-4.3.20.3 under FEDORA-2026-71a9784a57.

Published Sep 30, 2026

Updated

A flaw was found in collectl's colmux utility. colmux receives monitoring data from remote collectl instances over TCP port 2655 and renders it directly to the operator's terminal without neutralizing ANSI/VT100 terminal escape sequences. An unprivileged local user on any host monitored by collectl can embed terminal escape sequences in their process name (argv[0], read from /proc), which collectl (commonly run as root via its systemd unit, which has no User= directive) forwards unmodified to colmux. When an operator views this data via colmux, the injected sequences are interpreted by their terminal emulator, reliably allowing screen clearing and spoofed on-screen content. Depending on the operator's terminal emulator configuration, this could conditionally extend to clipboard manipulation or, if the operator pastes unseen clipboard content into a shell, command execution. The issue was fixed upstream in collectl 4.3.20.2/4.3.20.3 by sanitizing remote data at ingestion in colmux and at the source in collectl's formatit.ph, gated by a default-on sanitizer with a --rawescape opt-out flag for trusted networks. Fedora has shipped the fix (collectl-4.3.20.3, FEDORA-2026-71a9784a57).

Other sources

colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted process name (argv[0]).

— MITRE

Affected Software

1 affected component

collectl collectl<4.3.20.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade collectl to a version that resolves this vulnerability.
Fixed in 4.3.20.3Patch FEDORA-2026-71a9784a57
Configuration
Keep the default-on escape-sequence sanitizer enabled; use the --rawescape opt-out only on trusted networks.
collectl/colmux --rawescape = disabled

Event History

Sep 30, 2026

Data Sourced

via Red Hat·03:41 PM

DescriptionSeverityAffected Software

Oct 1, 2026

CVE Published

via MITRE·08:35 AM

Data Sourced

via MITRE·08:35 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue in practice?

Operators who use colmux to view monitoring data from remote collectl instances are exposed, particularly when any monitored host permits an unprivileged local user to control process names. The default systemd deployment commonly runs collectl as root, so process-name data from such users can be forwarded to colmux.

What does an attacker need to exploit it?

An attacker needs unprivileged local access on a host monitored by collectl and must be able to cause an operator to view the host's data through colmux. Exploitation relies on embedding ANSI/VT100 escape sequences in a process name, such as argv[0].

Are default configurations affected?

The upstream fix uses a sanitizer that is enabled by default; prior behavior rendered received data directly in the operator's terminal. The described systemd unit has no User= directive, so collectl commonly runs as root.

What can be done if updating is not immediately possible?

Avoid using colmux to display data from untrusted or potentially user-controlled monitored hosts, and treat terminal output from those hosts as untrusted. Do not enable the --rawescape opt-out except on trusted networks.

How can I determine whether a fix is available?

Upstream fixed the issue in collectl 4.3.20.2 and 4.3.20.3. Fedora shipped the fix in collectl-4.3.20.3 under FEDORA-2026-71a9784a57.

CVE-2026-103431: Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape sequences in data received from remote collectl instances

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue in practice?

What does an attacker need to exploit it?

Are default configurations affected?

What can be done if updating is not immediately possible?

How can I determine whether a fix is available?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue in practice?

What does an attacker need to exploit it?

Are default configurations affected?

What can be done if updating is not immediately possible?

How can I determine whether a fix is available?