GCVE - cpe:2.3:a:linuxfabrik:monitoring-plugins:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:linuxfabrik:monitoring-plugins:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Linuxfabrik (`9ea14742-c009-579c-9fc8-9b2094610bc4`)
Product	Monitoring Plugins (`c9cbea52-ec7c-5203-9fa3-0dff8b74ccbb`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-67433`	vulnerable	2026-09-16 04:33:06.027481	Linuxfabrik monitoring-plugins: Symlink following in logfile legacy database migration Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename() and allowed a local user controlling the plugin account to place a symlink that would be followed by sqlite3.connect() during a root-run check. Published: 2026-07-29T19:27:41.844Z Updated: 2026-07-30T13:07:26.335Z Open on db.gcve.eu Reference links https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-w2gg-hx6w-24w3 https://github.com/Linuxfabrik/monitoring-plugins/commit/6df1f574aa9dc6541e092f1ce482ecc1315cded0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-67436`	vulnerable	2026-09-16 04:33:05.920570	*Linuxfabrik monitoring-plugins: SSRF and auth-token disclosure via unvalidated @odata.id link in redfish- plugins** Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish-* plugins built request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, allowing a malicious or compromised BMC to redirect authenticated Redfish requests and disclose X-Auth-Token or HTTP Basic credentials. Published: 2026-07-29T19:43:35.819Z Updated: 2026-07-30T15:19:02.700Z Open on db.gcve.eu Reference links https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-96fx-pqc3-28xv https://github.com/Linuxfabrik/monitoring-plugins/commit/ffb0a81308cbfc018da857a89e0d07a67bf89fc3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-67435`	vulnerable	2026-09-16 04:33:05.693506	linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 6.0.0, lib.url.fetch() followed cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie, allowing a malicious redirect-capable server to receive headers such as X-Auth-Token from authenticated monitoring requests. This issue is fixed in version 6.0.0. Published: 2026-07-29T19:39:19.088Z Updated: 2026-07-29T19:55:54.318Z Open on db.gcve.eu Reference links https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-4jc5-g844-4x33 https://github.com/Linuxfabrik/lib/commit/6573ff9347e541200305d278d2663d2e54e052ff https://github.com/Linuxfabrik/lib/releases/tag/v6.0.0	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.