Answer in brief
CVE-2026-73974 records a Medium severity (CVSS 5.5) vulnerability in linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE). The current sources do not mark it as known exploited. The current feed maps Linuxfabrik/lib (generic), Linuxfabrik/monitoring-plugins (generic), linuxfabrik-lib (pip), linuxfabrik-lib (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linuxfabrik/lib (generic), Linuxfabrik/monitoring-plugins (generic), linuxfabrik-lib (pip), linuxfabrik-lib (pypi). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linuxfabrik/libgeneric | < 6.0.1 | Not reported |
| Linuxfabrik/monitoring-pluginsgeneric | < 7.0.0 | Not reported |
| linuxfabrik-libpip | <6.1.0 | 6.1.0 |
| linuxfabrik-libpypi | >=0 <6.1.0 | 6.1.0 |
Published upstream
Aug 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 18, 2026
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test() treated the first or second element of a --test CSV argument as a filesystem path and returned the file contents as simulated standard output or standard error without path confinement. The hidden but production-accessible --test argument was accepted by sudo-authorized plugins, so an attacker controlling the nagios or icinga account could use check-plugins/deb-updates/deb-updates with its default QUERY=1 to disclose every line of a root-readable file. Approximately 22 other plugins exposed filtered content or a root file existence and readability oracle through the same helper, while check-plugins/network-bonding/network-bonding and check-plugins/openstack-swift-stat/openstack-swift-stat had direct read paths that bypassed the helper. The library fix confines fixture reads to the invoking plugin's unit-test directory and refuses unsafe anchors, and the plugin fix routes the two bypasses through that helper. These issues are fixed in linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0.
Quoted source text, attributed separately from HOL analysis.