PT-2026-55478 · Pypi · Linuxfabrik-Lib
Published
2026-07-02
·
Updated
2026-07-02
·
CVE-2026-52817
CVSS v4.0
7.0
High
| Vector | AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P |
Summary
In the Debian.sudoers file,
apt-get is allowed for the nagios user. The full command including the arguments are not enforced and can therefore be choosen arbitrarily. This allows to easily get a root shell as the nagios user:PoC
By choosing a particular argument, you can get (as a nagios user) a root shell:
sudo apt-get update -o APT::Update::Pre-Invoke::="/bin/sh"Since the nagious user can use sudo to run apt-get as root, the resulting shell is also running as root.
Impact
The vulnerability is a local privilege escalation, impacting users who use the provided sudoers file. It requires that an attacker already compromised the nagios account (which is quite a high barrier to be honest).
Fix
Since only one place where
apt-get is currently used (in deb-updates) was found, it should be enough to allow only the specific arguments used there.Here an example how the line in the sudoers file could look like:
/usr/lib64/nagios/plugins/strongswan-connections,
/usr/lib64/nagios/plugins/systemd-unit,
/usr/bin/apt-get update --quiet 2Fix
Argument Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxfabrik-Lib