CVE-2026-67436 in monitoring-plugins
Summary
by MITRE • 07/29/2026
Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish-* plugins built request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, allowing a malicious or compromised BMC to redirect authenticated Redfish requests and disclose X-Auth-Token or HTTP Basic credentials.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability exists within the Linuxfabrik monitoring-plugins version 6.0.0 and earlier, specifically affecting the redfish-* plugins designed for Icinga, Nagios, and similar monitoring systems. This security flaw stems from improper URL handling mechanisms that concatenate user-supplied base URLs with response-supplied @odata.id links obtained from Redfish API interactions. The technical implementation fails to validate or sanitize the odata.id values returned by the Redfish service, creating a path traversal and credential exposure vulnerability.
The operational impact of this vulnerability is significant as it enables malicious or compromised Baseboard Management Controllers (BMCs) to manipulate authenticated Redfish requests through crafted @odata.id responses. When monitoring plugins execute requests against the Redfish API, they blindly concatenate the operator-provided base URL with the odata.id link returned by the BMC, potentially redirecting subsequent requests to unauthorized endpoints. This flaw allows attackers to intercept and disclose sensitive authentication credentials including X-Auth-Token values and HTTP Basic authentication headers that are typically transmitted with Redfish requests.
This vulnerability aligns with CWE-601 URL Redirection to Untrusted Site ('Open Redirect') and CWE-352 Cross-Site Request Forgery, as it enables unauthorized redirection of authenticated requests while also exposing credential handling mechanisms. The attack vector follows ATT&CK technique T1566.001 Phishing via Service Provider, where compromised BMCs can serve as initial access points to redirect monitoring traffic and extract authentication tokens. The flaw particularly affects environments using Redfish-based monitoring solutions where the base URL is configurable by operators, creating a trust boundary that malicious BMCs can exploit.
Organizations utilizing these monitoring plugins should immediately update to versions 6.0.1 or later where proper URL validation has been implemented to prevent concatenation of untrusted odata.id values with operator-supplied base URLs. The mitigation strategy requires implementing strict input validation that sanitizes all @odata.id responses before use in subsequent requests, ensuring that any redirection attempts are properly validated against a known trusted domain list. Network segmentation and monitoring of Redfish API traffic should be enhanced to detect unauthorized redirection patterns, while credential rotation should be performed immediately for systems where the vulnerability may have been exploited. Additionally, operators should review their Redfish endpoint configurations to minimize trust in potentially compromised BMCs and implement additional authentication layers for monitoring systems accessing critical infrastructure management interfaces.