Linuxfabrik Monitoring Plugins/Linuxfabrik-lib Testing Helper deb-updates lib.lftest.test information disclosure

Summaryinfo

A vulnerability marked as problematic has been reported in Linuxfabrik Monitoring Plugins and Linuxfabrik-lib. Affected is the function lib.lftest.test of the file check-plugins/deb-updates/deb-updates of the component Testing Helper. The manipulation of the argument test leads to information disclosure. This vulnerability is traded as CVE-2026-73974. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability was found in Linuxfabrik Monitoring Plugins and Linuxfabrik-lib (the affected version is unknown). It has been rated as problematic. This issue affects the function lib.lftest.test of the file check-plugins/deb-updates/deb-updates of the component Testing Helper. The manipulation of the argument test with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test() treated the first or second element of a --test CSV argument as a filesystem path and returned the file contents as simulated standard output or standard error without path confinement. The hidden but production-accessible --test argument was accepted by sudo-authorized plugins, so an attacker controlling the nagios or icinga account could use check-plugins/deb-updates/deb-updates with its default QUERY=1 to disclose every line of a root-readable file. Approximately 22 other plugins exposed filtered content or a root file existence and readability oracle through the same helper, while check-plugins/network-bonding/network-bonding and check-plugins/openstack-swift-stat/openstack-swift-stat had direct read paths that bypassed the helper. The library fix confines fixture reads to the invoking plugin's unit-test directory and refuses unsafe anchors, and the plugin fix routes the two bypasses through that helper. These issues are fixed in linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-73974 since 08/13/2026. The exploitation is known to be easy. Attacking locally is a requirement. Additional levels of successful authentication are needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Linuxfabrik

Name

• Linuxfabrik-lib
• Monitoring Plugins

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion