Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55426— linuxfabrik-lib: Local privilege escalation using embedded command

Quick assessment

Affected
Linuxfabrik monitoring-plugins
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linuxfabrik Python Libraries是Linuxfabrik组织开源的一系列Python开发库。 Linuxfabrik Python Libraries 6.0.0之前版本存在命令注入漏洞，该漏洞源于命令字符串处理不当，用户可控值被嵌入命令字符串并传递给shell_exec()，通过管道字符分隔执行，可能导致命令注入，攻击者可通过--repo参数注入管道分隔命令，并利用sudo授权以root权限执行任意命令。

CVSS 7.8 · High EPSS 0.21% · P11

Affected Version Matrix 2

VendorProduct Version RangeStatus
Linuxfabrik lib < 5.0.0 affected
Linuxfabrik monitoring-plugins < 6.0.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55426

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
linuxfabrik-lib: Local privilege escalation using embedded command
Source: CVE Program / CVE List V5
Vulnerability Description
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The shared library also accepted command strings and a shell parameter, while numerous plugins constructed external commands from attacker-influenced arguments. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Linuxfabrik Python Libraries 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linuxfabrik Python Libraries是Linuxfabrik组织开源的一系列Python开发库。 Linuxfabrik Python Libraries 6.0.0之前版本存在命令注入漏洞，该漏洞源于命令字符串处理不当，用户可控值被嵌入命令字符串并传递给shell_exec()，通过管道字符分隔执行，可能导致命令注入，攻击者可通过--repo参数注入管道分隔命令，并利用sudo授权以root权限执行任意命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linuxfabrik monitoring-plugins < 6.0.0 -
Linuxfabrik lib < 5.0.0 -

II. Public POCs for CVE-2026-55426

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55426

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-55426 (1)

Other References for CVE-2026-55426 (2)

Same Patch Batch · Linuxfabrik · 2026-08-18 · 5 CVEs total

CVE-2026-52817 7.0 HIGH Linuxfabrik Monitoring Plugins Sudoers: /usr/bin/apt-get arguments allow privilege escalat
CVE-2026-73973 5.5 MEDIUM Linuxfabrik Monitoring Plugins: Arbitrary root file disclosure via unconfined --filename i
CVE-2026-73974 5.5 MEDIUM linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sud
CVE-2026-53759 2.0 LOW linuxfabrik-lib: Insecure creation of SQLite databases

IV. Related Vulnerabilities

Same product: monitoring-plugins
Same vendor: Linuxfabrik
Same weakness: CWE-78