
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2026-55426 is a local privilege escalation vulnerability in Linuxfabrik Monitoring Plugins caused by OS command injection via unsanitized user input passed to shell_exec. When check plugins (such as restic-check) embed user-supplied arguments directly into shell commands, an attacker with access to the nagios user can inject pipe-delimited commands to execute arbitrary code as root — particularly when the plugin is listed in the sudoers file. The vulnerability affects linuxfabrik-lib versions prior to 5.0.0 (pip) and Linuxfabrik Monitoring Plugins versions up to and including 5.2.0. It was first published on June 12, 2026, and added to the GitHub Advisory Database on July 6, 2026. The CVSS v3.1 base score is 7.8 (High) (GitHub Advisory, Linuxfabrik Advisory).
The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), where the shell_exec function in linuxfabrik-lib accepts a command string and splits it on pipe (|) characters before executing each segment separately. User-provided arguments (e.g., --repo in the restic-check plugin) are concatenated directly into this command string without sanitization or quoting, allowing an attacker to inject shell metacharacters. For example, passing --repo '|touch /root/nagios-was-here|' causes shell_exec to split and execute the embedded touch command as a separate process. Exploitation requires local access as the nagios user (low privileges), no user interaction, and the target plugin must be configured with sudo privileges in the sudoers file (GitHub Advisory, Linuxfabrik Advisory).
Successful exploitation allows an attacker who controls the nagios user to escalate privileges to root on the affected system, achieving full confidentiality, integrity, and availability compromise. An attacker can read sensitive system files, modify or destroy data, install backdoors, or disrupt monitoring services. The impact is scoped to the local system but can serve as a stepping stone for broader lateral movement within a network if the monitoring host has privileged access to other systems (GitHub Advisory, Linuxfabrik Advisory).
nagios user on the target system (e.g., via a compromised Nagios/Icinga service or another vulnerability)./etc/sudoers or /etc/sudoers.d/ for Linuxfabrik monitoring plugins (e.g., restic-check) that are permitted to run as root without a password.'|<malicious_command>|'.nagios@test-vm:/$ sudo /usr/lib64/nagios/plugins/restic-check --repo '|touch /root/nagios-was-here|'shell_exec function splits the assembled command string at | boundaries and executes the embedded command as root, completing the privilege escalation (GitHub Advisory, Linuxfabrik Advisory)./var/log/auth.log or /var/log/secure) showing the nagios user invoking monitoring plugins with unusual arguments containing pipe characters (|)./root/) by the nagios or root user; new cron jobs, SSH keys, or scripts added to root's home directory.touch, bash, curl, wget, python) running as root.Upgrade linuxfabrik-lib to version 5.0.0 or later (pip), which removes the | split functionality from shell_exec and requires commands to be passed as argument lists (argv) with shell=False, preventing user input from breaking out of the command. Upgrade Linuxfabrik Monitoring Plugins to version 6.0.0 or any release after v5.2.0, which assembles all external commands as argv lists. As an interim workaround, review and restrict sudoers entries for Linuxfabrik monitoring plugins to limit which plugins can be run as root, and audit plugin arguments for pipe characters. Additionally, consider using shlex.quote for any user-provided arguments if immediate patching is not possible (GitHub Advisory, Linuxfabrik Advisory).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."