CVE-2026-67433

monitoring-plugins symlink vulnerability allows local privilege escalation.

• CVSS 5.8
• 59
• Race Conditions
• Local

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename() and allowed a local user controlling the plugin account to place a symlink that would be followed by sqlite3.connect() during a root-run check.

CVE

CVE-2026-67433

CWE

59

CVSS base score

5.8

Published

2026-07-29

OWASP

A01 Broken Access Control

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Race Conditions

Subcategory

Time-of-Check to Time-of-Use

Accessibility scope

Local

Impact

Privilege Escalation

Affected component

Linuxfabrik

Fixed by upgrading

Yes

Solution

Upgrade to version 6.0.1 or later.

import os
import sqlite3

def migrate_legacy_db(state_dir):
    """
    Migrates the legacy database from /tmp to the state directory.
    """
    legacy_db_path = '/tmp/monitoring_legacy.db'
    new_db_path = os.path.join(state_dir, 'monitoring.db')

    if not os.path.exists(new_db_path):
        if os.path.exists(legacy_db_path):
            # VULNERABLE: predictable path in /tmp is moved without checking if it's a symlink
            os.rename(legacy_db_path, new_db_path)

    # If an attacker creates a symlink at legacy_db_path pointing to a
    # system file, the root-run process will move the symlink to new_db_path.
    # sqlite3.connect() will follow the symlink and can corrupt the target file.
    try:
        conn = sqlite3.connect(new_db_path)
        conn.close()
    except sqlite3.Error:
        pass

import os
import sqlite3

def migrate_legacy_db(state_dir):
    """
    Migrates the legacy database from /tmp to the state directory.
    """
    legacy_db_path = '/tmp/monitoring_legacy.db'
    new_db_path = os.path.join(state_dir, 'monitoring.db')

    if not os.path.exists(new_db_path):
        # FIX: check if the source is a symlink before moving it from a world-writable directory
        if os.path.lexists(legacy_db_path) and not os.path.islink(legacy_db_path):
            os.rename(legacy_db_path, new_db_path)

    # The check prevents the symlink from being moved, thus sqlite3.connect()
    # cannot be tricked into opening an arbitrary file path.
    try:
        conn = sqlite3.connect(new_db_path)
        conn.close()
    except sqlite3.Error:
        pass

ln -s /etc/root_owned_file.db /tmp/monitoring-plugins-logfile-db.sqlite3

@misc{vaitp:cve202667433,
  title        = {{monitoring-plugins symlink vulnerability allows local privilege escalation.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-67433},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-67433/}}
}