CVE-2026-73974 linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)
Attackers with monitoring account access can read arbitrary root files via a hidden test argument in Linuxfabrik plugins, leading to information disclosure and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73974?
CVE-2026-73974 is a medium-severity path traversal vulnerability in Linuxfabrik lib, published on 18 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test() treated the first or second element of a --test CSV argument as a filesystem path and returned the file contents as simulated standard output or standard error without path confinement. The hidden but production-accessible --test argument was accepted by sudo-authorized plugins, so an attacker controlling the nagios or icinga account could use check-plugins/deb-updates/deb-updates with its default QUERY=1 to disclose every line of a root-readable file. Approximately 22 other plugins exposed filtered content or a root file existence and readability oracle through the same helper, while check-plugins/network-bonding/network-bonding and check-plugins/openstack-swift-stat/openstack-swift-stat had direct read paths that bypassed the helper. The library fix confines fixture reads to the invoking plugin's unit-test directory and refuses unsafe anchors, and the plugin fix routes the two bypasses through that helper. These issues are fixed in linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0.
Which versions are affected by CVE-2026-73974?
3 open source packages ship an affected version, including linuxfabrik-lib.
| Package | Affected | Fixed in |
|---|---|---|
linuxfabrik-lib PyPI | All versions | 6.1.0 |
linuxfabrik-lib PyPI | All versions | 6.1.0 |
linuxfabrik-lib PyPI | All versions | 6.1.0 |
How do I fix CVE-2026-73974?
Upgrade linuxfabrik-lib to 6.1.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-73974 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73974 exists.
Sources
Also known as GHSA-rh9c-rqvg-f7pr, PYSEC-2026-3682.