REDHAT-BUG-2543974: High severity collectl collectl vulnerability
A flaw was found in collectl's colmux utility. colmux receives monitoring data from remote collectl instances over TCP port 2655 and renders it directly to the operator's terminal without neutralizing ANSI/VT100 terminal escape sequences. An unprivileged local user on any host monitored by collectl can embed terminal escape sequences in their process name (argv[0], read from /proc), which collectl (commonly run as root via its systemd unit, which has no User= directive) forwards unmodified to colmux. When an operator views this data via colmux, the injected sequences are interpreted by their terminal emulator, reliably allowing screen clearing and spoofed on-screen content. Depending on the operator's terminal emulator configuration, this could conditionally extend to clipboard manipulation or, if the operator pastes unseen clipboard content into a shell, command execution. The issue was fixed upstream in collectl 4.3.20.2/4.3.20.3 by sanitizing remote data at ingestion in colmux and at the source in collectl's formatit.ph, gated by a default-on sanitizer with a --rawescape opt-out flag for trusted networks. Fedora has shipped the fix (collectl-4.3.20.3, FEDORA-2026-71a9784a57).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
collectlto a version that resolves this vulnerability.Fixed in 4.3.20.3Patch FEDORA-2026-71a9784a57 - Configuration
Keep the default-on sanitizer enabled; use the --rawescape opt-out flag only for trusted networks.
collectl/colmux sanitizer = enabled
Event History
Frequently Asked Questions
Who can inject the malicious terminal content?
An unprivileged local user on any host monitored by collectl can place ANSI/VT100 escape sequences in a process name via argv[0]. Collectl reads the name from /proc and can forward it to the operator's colmux display.
What must happen for an operator to be affected?
The operator must view the remote monitoring data through colmux, causing the terminal emulator to interpret the injected escape sequences. Screen clearing and spoofed terminal content are reliable; clipboard manipulation or command execution depends on terminal emulator settings and the operator pasting unseen clipboard contents into a shell.
Is a default deployment exposed?
The described systemd unit commonly runs collectl as root because it has no User= directive. The upstream remediation enables sanitization by default; --rawescape disables that protection for trusted networks.
What can be done before patching?
Avoid viewing data from untrusted monitored hosts through colmux, and do not paste clipboard content or commands that may have been obscured in the terminal. Treat terminal output from affected remote collectl instances as untrusted.
How can I determine whether the available fixed package is installed?
The issue was fixed upstream in collectl 4.3.20.2/4.3.20.3. Fedora shipped the fix in collectl-4.3.20.3 under FEDORA-2026-71a9784a57.