CVE-2026-67436 Linuxfabrik monitoring-plugins: SSRF and auth-token disclosure via unvalidated @odata.id link in redfish-* plugins
A malicious BMC can redirect authenticated Redfish requests to disclose credentials and perform server-side request forgery in Linuxfabrik monitoring plugins.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-67436?
CVE-2026-67436 is a high-severity server-side request forgery vulnerability in Linuxfabrik monitoring-plugins, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish-* plugins built request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, allowing a malicious or compromised BMC to redirect authenticated Redfish requests and disclose X-Auth-Token or HTTP Basic credentials.
Which versions are affected by CVE-2026-67436?
How do I fix CVE-2026-67436?
No fix has been published for CVE-2026-67436 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-67436 being exploited?
There is no known exploitation of CVE-2026-67436 in the wild and no public exploit code.
Sources
Also known as GHSA-96fx-pqc3-28xv.