{"id":"CVE-2026-55426","aliases":["EUVD-2026-61493","GHSA-798h-hpph-m24j","PYSEC-2026-2594"],"status":"published","title":"linuxfabrik-lib: Local privilege escalation using embedded command","description":"linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The shared library also accepted command strings and a shell parameter, while numerous plugins constructed external commands from attacker-influenced arguments. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00211,"percentile":0.11438,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2026-07-06T21:13:38Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"PyPI","package":"linuxfabrik-lib","fixed_in":["5.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"linuxfabrik-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"linuxfabrik-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0"}]}],"versions":["2.0.0.0","2.0.0.7","2.1.0.0","2.1.0.4","2.1.1.15","2.1.1.5","2.1.1.7","2.2.0","2.2.1","2.3.0","2.4.0","3.0.0","3.1.0","3.1.1","3.2.0","3.3.0","3.4.0","3.4.1","4.0.0","4.0.1","4.0.2","4.1.0","4.2.0","4.3.0","4.4.0"]},{"source":"osv","ecosystem":"PyPI","package":"linuxfabrik-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0"}]}],"versions":["2.0.0.0","2.0.0.7","2.1.0.0","2.1.0.4","2.1.1.15","2.1.1.5","2.1.1.7","2.2.0","2.2.1","2.3.0","2.4.0","3.0.0","3.1.0","3.1.1","3.2.0","3.3.0","3.4.0","3.4.1","4.0.0","4.0.1","4.0.2","4.1.0","4.2.0","4.3.0","4.4.0"]}],"products":[{"vendor":"linuxfabrik","product":"lib"},{"vendor":"linuxfabrik","product":"monitoring-plugins"}],"references":[{"url":"https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-798h-hpph-m24j","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/Linuxfabrik/monitoring-plugins/commit/23bb570f41fc8d9caf30b30074bba0e3db1b357a","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/Linuxfabrik/lib/blob/main/CHANGELOG.md","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/Linuxfabrik/lib/releases/tag/v5.0.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/Linuxfabrik/monitoring-plugins/blob/main/CHANGELOG.md","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/Linuxfabrik/monitoring-plugins/releases/tag/v6.0.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-798h-hpph-m24j","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55426.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55426","tags":["advisory"]},{"url":"https://github.com/Linuxfabrik/monitoring-plugins","tags":["package"]},{"url":"https://pypi.org/project/linuxfabrik-lib","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-55426","title":"linuxfabrik-lib: Local privilege escalation using embedded command","description":"linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The shared library also accepted command strings and a shell parameter, while numerous plugins constructed external commands from attacker-influenced arguments. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0.","status":"published","published":"2026-08-18T20:57:59.873Z","modified":"2026-08-20T18:26:01.989Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:20:12.260247Z"}],"euvd":[{"id":"EUVD-2026-61493","description":"linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The shared library also accepted command strings and a shell parameter, while numerous plugins constructed external commands from attacker-influenced arguments. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0.","status":"published","published":"2026-08-18T20:57:59Z","modified":"2026-08-20T18:26:01Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:38.846525Z"}],"ghsa":[{"id":"GHSA-798h-hpph-m24j","title":"Linuxfabrik Monitoring Plugins have local privilege escalation using embedded command","description":"### Summary\nWhen a check plugin places user provided input inside a command which is passed to `shell_exec`, an attacker can abuse this to run arbitrary commands. This is mainly dangerous for plugins which are listed in the sudoers file, because this allows an attacker controlling the nagios user to get root privileges.\n\n### Details\nAn example for this is the `restic-check` plugin, where the `--repo` argument is placed inside the command argument of `shell_exec`. As an example, an attacker could use the `--repo` argument `|touch /root/nagios-was-here|`. The full restic command is assembled to the string `restic --json --repo=|touch /root/nagios-was-here| --password-file= check` before it is passed to `shell_exec`. `shell_exec` then splits the command up in three parts at the | boundaries and executes the parts separately, which also executes the embedded command `touch /root/nagios-was-here`.\n\n### PoC\nThis PoC shows how the nagios user can use this to create a file inside `/root`.\n```\nnagios@test-vm:/$ sudo /usr/lib64/nagios/plugins/restic-check --repo '|touch /root/nagios-was-here|'\n```\n\n### Impact\nThe vulnerability is a local privilege escalation.\n\n### Fix\n\n#### Switch from | to an array\nRemove the | split functionality. Instead, modify shell_exec to accept either a string or an array of strings. If an array is provided, the commands are chained together like they currently are when using |. If a string is provided, no split should be performed. You could also introduce a separate function like `shell_exec_with_user_input()` which implements this such that the current shell_exec function can stay like it is.\n\nThis leaves the problem that an attacker can still specify arbitrary arguments inside a command. An example for this would be to use the `--repo` argument `sftp://example.com --cache-dir /tmp`, which would lead to the execution of: `restic --json --repo=sftp://example.com --cache-dir /tmp --password-file=None check`. Please note that this example should mainly highlight the problem in general. To prevent the problem, there is either escaping or again array-syntax. Escaping would use `shlex.quote` to place the user provided argument inside quotes and which also escapes everything which needs to be escaped. Using array syntax would mean providing the full command as an array like `['restic', '--json', '--repo', 'sftp://example.com']`. The array can then be given as-is to `Popen`. With this method, the proposed `shell_exec_with_user_input` would accept an array of array of strings.\n\n### Patches\n\nThe fix follows the array-syntax approach proposed above:\n\n* `linuxfabrik-lib` 5.0.0: `lib.shell.shell_exec()` requires the command as a list of\n  arguments (argv) and always runs with `shell=False`. The `|` split functionality, command\n  strings and the `shell=` parameter have been removed, so user-provided input can no longer\n  break out of a command. `lib.shell.safe_cli_value()` additionally guards positional\n  arguments (such as an ssh destination or a ping target) against option injection, and\n  `lib.ssh` builds argument lists as well.\n* Linuxfabrik Monitoring Plugins: all plugins assemble their external commands as argv lists\n  (commit 23bb570f4). Contained in every release after v5.2.0.","status":"published","published":"2026-07-06T21:13:38Z","modified":"2026-07-06T21:13:39Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:40:39.314643Z"}],"nvd":[{"id":"CVE-2026-55426","description":"linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The shared library also accepted command strings and a shell parameter, while numerous plugins constructed external commands from attacker-influenced arguments. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0.","status":"published","published":"2026-08-18T21:16:36.46Z","modified":"2026-09-09T21:13:25.91Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:38.976695Z"}],"osv":[{"id":"CVE-2026-55426","title":"linuxfabrik-lib: Local privilege escalation using embedded command","description":"linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The shared library also accepted command strings and a shell parameter, while numerous plugins constructed external commands from attacker-influenced arguments. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0.","status":"published","published":"2026-08-18T20:57:59.873Z","modified":"2026-10-28T02:30:54.008475931Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"GHSA-798h-hpph-m24j","title":"Linuxfabrik Monitoring Plugins have local privilege escalation using embedded command","description":"### Summary\nWhen a check plugin places user provided input inside a command which is passed to `shell_exec`, an attacker can abuse this to run arbitrary commands. This is mainly dangerous for plugins which are listed in the sudoers file, because this allows an attacker controlling the nagios user to get root privileges.\n\n### Details\nAn example for this is the `restic-check` plugin, where the `--repo` argument is placed inside the command argument of `shell_exec`. As an example, an attacker could use the `--repo` argument `|touch /root/nagios-was-here|`. The full restic command is assembled to the string `restic --json --repo=|touch /root/nagios-was-here| --password-file= check` before it is passed to `shell_exec`. `shell_exec` then splits the command up in three parts at the | boundaries and executes the parts separately, which also executes the embedded command `touch /root/nagios-was-here`.\n\n### PoC\nThis PoC shows how the nagios user can use this to create a file inside `/root`.\n```\nnagios@test-vm:/$ sudo /usr/lib64/nagios/plugins/restic-check --repo '|touch /root/nagios-was-here|'\n```\n\n### Impact\nThe vulnerability is a local privilege escalation.\n\n### Fix\n\n#### Switch from | to an array\nRemove the | split functionality. Instead, modify shell_exec to accept either a string or an array of strings. If an array is provided, the commands are chained together like they currently are when using |. If a string is provided, no split should be performed. You could also introduce a separate function like `shell_exec_with_user_input()` which implements this such that the current shell_exec function can stay like it is.\n\nThis leaves the problem that an attacker can still specify arbitrary arguments inside a command. An example for this would be to use the `--repo` argument `sftp://example.com --cache-dir /tmp`, which would lead to the execution of: `restic --json --repo=sftp://example.com --cache-dir /tmp --password-file=None check`. Please note that this example should mainly highlight the problem in general. To prevent the problem, there is either escaping or again array-syntax. Escaping would use `shlex.quote` to place the user provided argument inside quotes and which also escapes everything which needs to be escaped. Using array syntax would mean providing the full command as an array like `['restic', '--json', '--repo', 'sftp://example.com']`. The array can then be given as-is to `Popen`. With this method, the proposed `shell_exec_with_user_input` would accept an array of array of strings.\n\n### Patches\n\nThe fix follows the array-syntax approach proposed above:\n\n* `linuxfabrik-lib` 5.0.0: `lib.shell.shell_exec()` requires the command as a list of\n  arguments (argv) and always runs with `shell=False`. The `|` split functionality, command\n  strings and the `shell=` parameter have been removed, so user-provided input can no longer\n  break out of a command. `lib.shell.safe_cli_value()` additionally guards positional\n  arguments (such as an ssh destination or a ping target) against option injection, and\n  `lib.ssh` builds argument lists as well.\n* Linuxfabrik Monitoring Plugins: all plugins assemble their external commands as argv lists\n  (commit 23bb570f4). Contained in every release after v5.2.0.","status":"published","published":"2026-07-06T21:13:38Z","modified":"2026-07-13T16:43:52.595858928Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"PYSEC-2026-2594","title":"Linuxfabrik Monitoring Plugins have local privilege escalation using embedded command","description":"### Summary\nWhen a check plugin places user provided input inside a command which is passed to `shell_exec`, an attacker can abuse this to run arbitrary commands. This is mainly dangerous for plugins which are listed in the sudoers file, because this allows an attacker controlling the nagios user to get root privileges.\n\n### Details\nAn example for this is the `restic-check` plugin, where the `--repo` argument is placed inside the command argument of `shell_exec`. As an example, an attacker could use the `--repo` argument `|touch /root/nagios-was-here|`. The full restic command is assembled to the string `restic --json --repo=|touch /root/nagios-was-here| --password-file= check` before it is passed to `shell_exec`. `shell_exec` then splits the command up in three parts at the | boundaries and executes the parts separately, which also executes the embedded command `touch /root/nagios-was-here`.\n\n### PoC\nThis PoC shows how the nagios user can use this to create a file inside `/root`.\n```\nnagios@test-vm:/$ sudo /usr/lib64/nagios/plugins/restic-check --repo '|touch /root/nagios-was-here|'\n```\n\n### Impact\nThe vulnerability is a local privilege escalation.\n\n### Fix\n\n#### Switch from | to an array\nRemove the | split functionality. Instead, modify shell_exec to accept either a string or an array of strings. If an array is provided, the commands are chained together like they currently are when using |. If a string is provided, no split should be performed. You could also introduce a separate function like `shell_exec_with_user_input()` which implements this such that the current shell_exec function can stay like it is.\n\nThis leaves the problem that an attacker can still specify arbitrary arguments inside a command. An example for this would be to use the `--repo` argument `sftp://example.com --cache-dir /tmp`, which would lead to the execution of: `restic --json --repo=sftp://example.com --cache-dir /tmp --password-file=None check`. Please note that this example should mainly highlight the problem in general. To prevent the problem, there is either escaping or again array-syntax. Escaping would use `shlex.quote` to place the user provided argument inside quotes and which also escapes everything which needs to be escaped. Using array syntax would mean providing the full command as an array like `['restic', '--json', '--repo', 'sftp://example.com']`. The array can then be given as-is to `Popen`. With this method, the proposed `shell_exec_with_user_input` would accept an array of array of strings.\n\n### Patches\n\nThe fix follows the array-syntax approach proposed above:\n\n* `linuxfabrik-lib` 5.0.0: `lib.shell.shell_exec()` requires the command as a list of\n  arguments (argv) and always runs with `shell=False`. The `|` split functionality, command\n  strings and the `shell=` parameter have been removed, so user-provided input can no longer\n  break out of a command. `lib.shell.safe_cli_value()` additionally guards positional\n  arguments (such as an ssh destination or a ping target) against option injection, and\n  `lib.ssh` builds argument lists as well.\n* Linuxfabrik Monitoring Plugins: all plugins assemble their external commands as argv lists\n  (commit 23bb570f4). Contained in every release after v5.2.0.","status":"published","published":"2026-07-13T15:46:28.776087Z","modified":"2026-07-13T16:32:03.335279197Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"}]}}