Linuxfabrik monitoring plugins: pipe injection in shell_exec escalates a check account to root

Impact

lib.shell.shell_exec() built command strings from user-influenced values and split them at pipe characters before executing, so a value like the restic-check --repo parameter could append a second command to the invocation. Because these checks are typically sudo-authorized, the appended command runs as root. The identity that matters is the monitoring account: a compromised nagios or icinga user on one host becomes root on that host, and the same account and the same sudo rules usually exist on every node the monitoring system covers, so this is a fleet-wide escalation path rather than a single-box bug. On GPU nodes the monitoring agent is one of the few things installed uniformly across the whole fleet, which is what makes it worth patching everywhere rather than on the noisiest hosts.

Who can reach it

A local user who already holds the nagios or icinga account on a monitored host, or anyone who can influence the arguments a check is invoked with - for example by editing check definitions on the monitoring server. Authentication is required (CVSS PR:L); this is not remotely reachable on its own.

What to do

Upgrade to linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, which switch to argv lists with shell=False, drop the pipe splitting, and reject option-like positional values via lib.shell.safe_cli_value(). The rollout is a package update on every monitored host - no daemon restart and no reboot, since checks are executed per invocation. While you are there, narrow the sudoers entries granted to the monitoring account to the specific plugin paths rather than a wildcard.

References

Related entries

• Apache Storm worker-launcher: TOCTOU on the command file gives a tenant root-equivalent container launchCVE-2026-82430 · Apache Storm worker-launcher (setuid-root Docker/OCI worker launch)High
• SonicWall SMA1000: authenticated admin can inject OS commands through the management consoleCVE-2026-83549 · SonicWall SMA1000 appliance (Appliance Management Console, OS command injection)High
• Linux kernel nfsd: module init error path leaves debugfs files pointing into freed module textCVE-2026-89668 · Linux kernel nfsd (debugfs init ordering in init_nfsd)High
• CyberPower PowerPanel managed devices - shared device certificates: Every managed device uses an identical certificateCVE-2024-31410 · CyberPower PowerPanel managed devices - shared device certificatesHigh
• Keycloak: SAML signature scope determined by position, not ReferenceCVE-2024-8698 · KeycloakHigh
• Tridium Niagara Framework and Niagara Enterprise Security (before 4.10.11 / 4.14.2 / 4.15.1): A chain, not a singleCVE-2025-3937 · Tridium Niagara Framework and Niagara Enterprise Security (before 4.10.11 / 4.14.2 / 4.15.1)High