CVE-2026-55426: 
Python vulnerability analysis and mitigation

CVE-2026-55426 is a local privilege escalation vulnerability in Linuxfabrik Monitoring Plugins caused by OS command injection via unsanitized user input passed to shell_exec. When check plugins (such as restic-check) embed user-supplied arguments into shell commands without sanitization, an attacker with access to the nagios user can inject pipe-delimited commands to execute arbitrary code. The vulnerability affects linuxfabrik-lib versions prior to 5.0.0 (pip package) and Linuxfabrik Monitoring Plugins versions up to and including 5.2.0. It was first published on June 12, 2026, and added to the GitHub Advisory Database on July 6, 2026. The CVSS v3.1 base score is 7.8 (High) (GitHub Advisory, Linuxfabrik Advisory).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), where the shell_exec function in linuxfabrik-lib accepts a command string and splits it on pipe (|) characters to chain commands. User-provided arguments (e.g., --repo in the restic-check plugin) are concatenated directly into this command string without escaping or quoting, allowing an attacker to inject shell metacharacters. For example, passing --repo '|touch /root/nagios-was-here|' causes shell_exec to split the assembled string restic --json --repo=|touch /root/nagios-was-here| --password-file= check at the | boundaries and execute the injected command touch /root/nagios-was-here as a separate process. Exploitation requires low privileges (nagios user access) and no user interaction, and is particularly dangerous when the affected plugins are listed in the sudoers file, enabling privilege escalation to root (GitHub Advisory, Linuxfabrik Advisory).

Successful exploitation allows a local attacker with nagios user privileges to escalate to root on the affected system, achieving full confidentiality, integrity, and availability compromise. Because Nagios check plugins are commonly granted passwordless sudo execution via the sudoers file, an attacker who gains control of the nagios user (e.g., through a separate vulnerability or misconfiguration) can leverage this flaw to execute arbitrary commands as root. This could enable persistent backdoor installation, credential theft, lateral movement within the monitored infrastructure, and complete system takeover (GitHub Advisory, Linuxfabrik Advisory).

1. Gain nagios user access: Obtain a shell or command execution as the nagios user on the target system, either through a separate vulnerability, credential theft, or social engineering.
2. Identify vulnerable plugins in sudoers: Check /etc/sudoers or /etc/sudoers.d/ for entries granting the nagios user passwordless sudo execution of Linuxfabrik check plugins (e.g., restic-check).
3. Confirm vulnerable version: Verify that linuxfabrik-lib is below version 5.0.0 or that Monitoring Plugins is version 5.2.0 or earlier.
4. Craft the injection payload: Construct a pipe-delimited argument for a vulnerable parameter such as --repo, embedding the desired command between pipe characters: '|<command>|'.
5. Execute the payload with sudo: Run the vulnerable plugin with the crafted argument via sudo, e.g., sudo /usr/lib64/nagios/plugins/restic-check --repo '|touch /root/nagios-was-here|'. The shell_exec function splits the assembled command string at | boundaries and executes the injected command as root.
6. Achieve root code execution: Replace the PoC command with a more impactful payload (e.g., adding an SSH key to /root/.ssh/authorized_keys, creating a SUID shell, or establishing a reverse shell) to achieve persistent root access (GitHub Advisory, Linuxfabrik Advisory).

• Logs: Sudo logs (/var/log/auth.log or /var/log/secure) showing the nagios user invoking Linuxfabrik check plugins with unusual arguments containing pipe characters (|).
• File System: Unexpected files created in privileged directories such as /root/ (e.g., nagios-was-here); new SUID binaries or modified /root/.ssh/authorized_keys; new cron jobs or scripts owned by root but writable by nagios.
• Process: Unusual child processes spawned by Nagios plugin processes running as root (e.g., touch, bash, curl, wget, python) visible in process audit logs (auditd) or ps output.
• Network: Unexpected outbound connections from the monitoring server to external IPs, particularly if a reverse shell payload was used.

Upgrade linuxfabrik-lib (pip) to version 5.0.0 or later, and Linuxfabrik Monitoring Plugins to version 6.0.0 or later (any release after v5.2.0 contains the fix). The fix replaces the pipe-split string approach in shell_exec with an argv list passed to Popen with shell=False, preventing shell metacharacter injection. A new lib.shell.safe_cli_value() function guards positional arguments against option injection. As an interim workaround, restrict sudoers entries for nagios plugins to the minimum necessary set and audit all plugins that accept user-controlled arguments passed to shell commands (GitHub Advisory, Linuxfabrik Advisory).