Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-52817— Linuxfabrik Monitoring Plugins Sudoers: /usr/bin/apt-get arguments allow privilege escalation

Quick assessment

Affected
Linuxfabrik monitoring-plugins
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linuxfabrik Python Libraries是Linuxfabrik组织开源的一系列Python开发库。 Linuxfabrik Python Libraries 5.1.0之前版本存在命令注入漏洞，该漏洞源于sudoers策略未对apt-get参数进行限制，可能导致攻击者通过APT::Update::Pre-Invoke选项执行任意命令并获取root权限，造成主机完全沦陷。

CVSS 7.0 · High EPSS 0.19% · P8

Affected Version Matrix 1

VendorProduct Version RangeStatus
Linuxfabrik monitoring-plugins < 5.1.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-52817

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Linuxfabrik Monitoring Plugins Sudoers: /usr/bin/apt-get arguments allow privilege escalation
Source: CVE Program / CVE List V5
Vulnerability Description
Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 5.1.0, the shipped assets/sudoers/Debian.sudoers policy allowed the nagios or icinga account to execute /usr/bin/apt-get as root without restricting its arguments. An attacker who already controls that monitoring account can supply the APT::Update::Pre-Invoke option to execute an arbitrary command while apt-get runs with root privileges, resulting in a root shell and complete compromise of the host. The vulnerable rule supports the check-plugins/deb-updates/deb-updates plugin, but it authorized arbitrary apt-get argument sequences rather than only the required apt-get update --quiet 2 command. This issue is fixed in version 5.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5
Vulnerability Title
Linuxfabrik Python Libraries 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linuxfabrik Python Libraries是Linuxfabrik组织开源的一系列Python开发库。 Linuxfabrik Python Libraries 5.1.0之前版本存在命令注入漏洞，该漏洞源于sudoers策略未对apt-get参数进行限制，可能导致攻击者通过APT::Update::Pre-Invoke选项执行任意命令并获取root权限，造成主机完全沦陷。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linuxfabrik monitoring-plugins < 5.1.0 -

II. Public POCs for CVE-2026-52817

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-52817

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-52817 (1)

Vendor Advisories for CVE-2026-52817 (1)

Vendor Pages for CVE-2026-52817 (1)

Same Patch Batch · Linuxfabrik · 2026-08-18 · 5 CVEs total

CVE-2026-55426 7.8 HIGH linuxfabrik-lib: Local privilege escalation using embedded command
CVE-2026-73973 5.5 MEDIUM Linuxfabrik Monitoring Plugins: Arbitrary root file disclosure via unconfined --filename i
CVE-2026-73974 5.5 MEDIUM linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sud
CVE-2026-53759 2.0 LOW linuxfabrik-lib: Insecure creation of SQLite databases

IV. Related Vulnerabilities

Same product: monitoring-plugins
Same vendor: Linuxfabrik
Same weakness: CWE-88

V. Comments for CVE-2026-52817

No comments yet

Leave a comment