CVE-2026-72694 Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation
Local attackers can exploit symlink following in MRTG to change file ownership, leading to privilege escalation and unauthorized file modification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72694?
CVE-2026-72694 is a high-severity path traversal vulnerability in Red Hat Enterprise Linux 10, published on 11 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.
Weakness: CWE-59
Which versions are affected by CVE-2026-72694?
Linux distribution packages (17)
mrtg AlmaLinux:10 | All versions | 2.17.10-12.el10_2.1 |
mrtg-selinux AlmaLinux:10 | All versions | 2.17.10-12.el10_2.1 |
mrtg AlmaLinux:8 | All versions | 2.17.7-1.el8_10.1 |
mrtg AlmaLinux:9 | All versions | 2.17.7-12.el9_8.1 |
mrtg Red Hat:enterprise_linux:10.2 | All versions | 0:2.17.10-12.el10_2.1 |
mrtg-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:2.17.10-12.el10_2.1 |
mrtg-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:2.17.10-12.el10_2.1 |
mrtg-selinux Red Hat:enterprise_linux:10.2 | All versions | 0:2.17.10-12.el10_2.1 |
mrtg Red Hat:enterprise_linux:8::appstream | All versions | 0:2.17.7-1.el8_10.1 |
mrtg-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:2.17.7-1.el8_10.1 |
mrtg-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:2.17.7-1.el8_10.1 |
mrtg Red Hat:enterprise_linux:9::appstream | All versions | 0:2.17.7-12.el9_8.1 |
mrtg-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:2.17.7-12.el9_8.1 |
mrtg-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:2.17.7-12.el9_8.1 |
mrtg Rocky Linux:10 | All versions | 0:2.17.10-12.el10_2.1 |
mrtg Rocky Linux:8 | All versions | 0:2.17.7-1.el8_10.1 |
mrtg Rocky Linux:9 | All versions | 0:2.17.7-12.el9_8.1 |
How do I fix CVE-2026-72694?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-72694 being exploited?
There is no known exploitation of CVE-2026-72694 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:57596, ALSA-2026:57600, ALSA-2026:65832, AZL-95885, CLSA-2026-1788267640, DEBIAN-CVE-2026-72694 and 8 more.