Description
Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nagios-nrpe | 2.15-1 | — |
| Debian 13 | nagios-nrpe | 2.15-1 | — |
| Debian 12 | nagios-nrpe | 2.15-1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | nrpe | 2.15-6.6.1 | SUSE-SU-2024:1417-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | nrpe | 2.15-6.6.1 | SUSE-SU-2024:1417-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nrpe | 4.0.3-3.5 | openSUSE-SU-2024:11099-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 2
- NRPE 2.15 - Remote Code Execution EDB-34461 · remote · Aug 29, 2014
- NRPE 2.15 - Remote Command Execution EDB-32925 · remote · Apr 18, 2014
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- openSUSE-SU-2024:11099-1 monitoring-plugins-nrpe-4.0.3-3.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1417-1 Security update for nrpe SUSE / openSUSE Security Updates · Feb 4, 2026
References
- openSUSE-SU-2014:0603 vendor-advisory
- 66969 vdb-entry
- [oss-security] 20140422 Re: CVE Request: Nagios Remote Plugin Executor <= 2.15 Remote Command Execution mailing-list
- FEDORA-2015-15398 vendor-advisory
- openSUSE-SU-2014:0594 vendor-advisory
- SUSE-SU-2014:0682 vendor-advisory
- [oss-security] 20140422 Re: CVE Request: Nagios Remote Plugin Executor <= 2.15 Remote Command Execution mailing-list
- 20140417 NRPE - Nagios Remote Plugin Executor <= 2.15 Remote Command Execution mailing-list
- 20140418 Re: NRPE - Nagios Remote Plugin Executor <= 2.15 Remote Command Execution mailing-list