Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in mrtg-2.17.10-12.el10_2.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- mrtg
Version range not reported
- mrtg
Version range not reported
- mrtg
Version range not reported
- mrtg
Version range not reported
- mrtg
Version range not reported
- mrtg
Version range not reported
- mrtg
Version range not reported
- mrtg
Version range not reported
- mrtg
Version range not reported
- mrtg
Version range not reported
- mrtg
Version range not reported
- mrtg
Version range not reported
- mrtg
Version range not reported
- mrtg
Version range not reported
- mrtg
Version range not reported
References 12
access.redhat.com
bugzilla.redhat.com
Questions about CVE-2026-72694
What should I do about it?
The listed fixed build is mrtg-2.17.10-12.el10_2.1 for RHEL 10, so the mrtg package should be updated to that build or later. The facts give no fixed build for other releases, so the matching build for each release should be confirmed in Red Hat's advisory. No workaround is listed.Source: access.redhat.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data