{"id":"CVE-2026-52817","title":"Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems","summary":"Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 5.1.0, the shipped assets/sudoers/Debian.sudoers policy allowed the nagios or icinga account to execute /usr/bin/apt-get…","severity":"high","cwe":["CWE-88"],"vendor":"linuxfabrik-lib","product":"linuxfabrik-lib","affected":["linuxfabrik-lib <= 5.0.0"],"patched":["linuxfabrik-lib 5.1.0"],"published":"2026-08-18","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:13:25.910","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52817","references":[{"url":"https://github.com/Linuxfabrik/monitoring-plugins/blob/main/CHANGELOG.md#v510---2026-05-30","label":"security-advisories@github.com"},{"url":"https://github.com/Linuxfabrik/monitoring-plugins/commit/694b5daeebadc9a51428f3de1acff7b1f737642f","label":"security-advisories@github.com"},{"url":"https://github.com/Linuxfabrik/monitoring-plugins/releases/tag/v5.1.0","label":"security-advisories@github.com"},{"url":"https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-8w6w-23mq-h8rg","label":"security-advisories@github.com"},{"url":"https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-8w6w-23mq-h8rg","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-8w6w-23mq-h8rg"}],"tags":["nvd","ghsa","pip"],"epss":0.00244,"epssPercentile":0.15911,"ecosystem":"pip","ingestedAt":"2026-07-02T20:42:45.646Z","slug":"CVE-2026-52817","body":"## Overview\n\nLinuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 5.1.0, the shipped assets/sudoers/Debian.sudoers policy allowed the nagios or icinga account to execute /usr/bin/apt-get as root without restricting its arguments. An attacker who already controls that monitoring account can supply the APT::Update::Pre-Invoke option to execute an arbitrary command while apt-get runs with root privileges, resulting in a root shell and complete compromise of the host. The vulnerable rule supports the check-plugins/deb-updates/deb-updates plugin, but it authorized arbitrary apt-get argument sequences rather than only the required apt-get update --quiet 2 command. This issue is fixed in version 5.1.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-52817)\n\nAffected packages:\n\n- `linuxfabrik-lib <= 5.0.0`\n\nPatched in:\n\n- `linuxfabrik-lib 5.1.0`\n\nSource: https://github.com/advisories/GHSA-8w6w-23mq-h8rg","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}