CVE-2026-67436CWE-20CWE-200CWE-918

Linuxfabrik monitoring-plugins: SSRF and auth-token disclosure via unvalidated @odata.id link in redfish-* plugins

High · published July 29, 2026

CVSS v4.0
8.3
EPSS
0%
Percentile
35.4
In the wild
Unconfirmed
What it is

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish-* plugins built request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, allowing a malicious or compromised BMC to redirect authenticated Redfish requests and disclose X-Auth-Token or HTTP Basic credentials.

The record
Technical detail
CVSS v4.0
8.3 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00421 · 35.4th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-29T19:43Z
EPSS history
Timeline
  • 29 JUL 19:43Z
    Linuxfabrik monitoring-plugins: SSRF and auth-token disclosure via unvalidated @odata.id link in redfish-* plugins
    cvelistv5