CVE-2026-73973: Linuxfabrik Monitoring Plugins: Arbitrary root file disclosure via unconfined --filename in logfile plugin (sudoers LPE)
Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 7.0.0, check-plugins/logfile/logfile accepted a free-form --filename path and opened it as root when invoked through the shipped nagios or icinga sudoers allowlist, without confining the resolved path to /var/log. An attacker who controls the monitoring account can select a root-readable file such as /etc/shadow and use --warning-regex . while leaving SUPPRESSOUTPUT false, causing each nonempty line to be collected in warnmatches and returned through lib.base.oao(). The vulnerable flow passes the expanded scanpath directly to open(), and neither real-path containment nor an allowlist protects the sink. The same fix also confines mysql-logfile and openvpn-client-list paths, allows only documented log roots, and resolves symlinks and parent-directory traversal before checking containment. This issue is fixed in version 7.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linuxfabrik Monitoring Plugins (check-plugins/logfile/logfile)to a version that resolves this vulnerability.Fixed in 7.0.0 - Upgrade
Upgrade
Linuxfabrik Monitoring Plugins (mysql-logfile)to a version that resolves this vulnerability.Fixed in 7.0.0 - Upgrade
Upgrade
Linuxfabrik Monitoring Plugins (openvpn-client-list)to a version that resolves this vulnerability.Fixed in 7.0.0
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
Systems are exposed when a user can control the monitoring account and invoke the affected plugins through the shipped nagios or icinga sudoers allowlist. Exploitation is local and requires low privileges, but no user interaction.
Is the default shipped sudoers configuration affected?
The vulnerable behavior is present in versions before 7.0.0 when logfile can be run as root through the shipped sudoers configuration. The unrestricted --filename argument is not confined to /var/log, and the same remediation also applies path confinement to mysql-logfile and openvpn-client-list.
What should be done if patching cannot happen immediately?
Upgrade to version 7.0.0. If an immediate upgrade is not possible, do not allow the monitoring account to invoke these plugins as root with attacker-controlled arguments, particularly --filename.
How can I look for signs of exploitation?
Review invocations of logfile for --filename values outside permitted log directories, including paths containing parent-directory traversal or symlinks, and inspect plugin output for unexpected content from root-readable files. A successful attempt can return nonempty file lines as warning matches when --warning-regex . is used and output is not suppressed.