Description
A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mrtg | 2.17.10-15 | — |
| Debian 13 | mrtg | 2.17.10-13+deb13u2 | — |
| Debian 12 | mrtg | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | mrtg | No fix yet | — |
| Ubuntu 26.04 LTS | mrtg | No fix yet | — |
| Ubuntu 24.04 LTS | mrtg | No fix yet | — |
| Ubuntu 22.04 LTS | mrtg | No fix yet | — |
| Ubuntu 20.04 LTS | mrtg | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | mrtg | No fix yet | — |
| Ubuntu 16.04 LTS | mrtg | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | mrtg +1 | 2.17.10-12.el10_2.1 | RHSA-2026:57596 |
| RHEL 9 | mrtg | 2.17.7-12.el9_8.1 | RHSA-2026:57600 |
| RHEL 8 | mrtg | 2.17.7-1.el8_10.1 | RHSA-2026:65832 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | mrtg +1 | 2.17.10-11.el10_0.1 | RHSA-2026:87255 |
| RHEL 9.6 EUS | mrtg | 2.17.7-11.el9_6.1 | RHSA-2026:91644 |
| RHEL 9.4 E4S | mrtg | 2.17.7-11.el9_4.1 | RHSA-2026:92051 |
| RHEL 9.2 E4S | mrtg | 2.17.7-10.el9_2.1 | RHSA-2026:92071 |
| RHEL 8.8 TUS | mrtg | 2.17.7-1.el8_8.1 | RHSA-2026:91843 |
| RHEL 8.8 E4S | mrtg | 2.17.7-1.el8_8.1 | RHSA-2026:91843 |
| RHEL 8.6 EUS Long Life | mrtg | 2.17.7-1.el8_6.1 | RHSA-2026:91844 |
| RHEL 8.6 AUS | mrtg | 2.17.7-1.el8_6.1 | RHSA-2026:91844 |
| RHEL 8.4 EUS Long Life | mrtg | 2.17.7-1.el8_4.1 | RHSA-2026:91845 |
| RHEL 8.4 AUS | mrtg | 2.17.7-1.el8_4.1 | RHSA-2026:91845 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | mrtg +1 | 2.17.10-12.el10_2.1 | ALSA-2026:57596 |
| AlmaLinux 9 | mrtg | 2.17.7-12.el9_8.1 | ALSA-2026:57600 |
| AlmaLinux 8 | mrtg | 2.17.7-1.el8_10.1 | ALSA-2026:65832 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | mrtg | 2.17.10-12.el10_2.1 | RLSA-2026:57596 |
| Rocky Linux 9 | mrtg | 2.17.7-12.el9_8.1 | RLSA-2026:57600 |
| Rocky Linux 8 | mrtg | 2.17.7-1.el8_10.1 | RLSA-2026:65832 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | mrtg | 2.17.4-11.amzn2.0.3 | ALAS2-2026-3884 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | mrtg | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | mrtg +1 | 2.17.10-12.el10_2.1 | ELSA-2026-57596 |
| Oracle Linux 9 | mrtg | 2.17.7-12.0.1.el9_8.1 | ELSA-2026-57600 |
Advisories 20
- RHSA-2026:92051 Red Hat Security Advisory: mrtg security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:92071 Red Hat Security Advisory: mrtg security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:91844 Red Hat Security Advisory: mrtg security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:91644 Red Hat Security Advisory: mrtg security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:91843 Red Hat Security Advisory: mrtg security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:91845 Red Hat Security Advisory: mrtg security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:87255 Red Hat Security Advisory: mrtg security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-2961 Red Hat Enterprise Linux (mrtg, kbd, urwid): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- ALSA-2026:57600 Important: mrtg security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:57596 Important: mrtg security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:65832 Important: mrtg security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:65832 Red Hat Security Advisory: mrtg security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RLSA-2026:65832 Important: mrtg security update Rocky Linux Security Advisories · Sep 9, 2026
- RHSA-2026:57600 Red Hat Security Advisory: mrtg security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- RHSA-2026:57596 Red Hat Security Advisory: mrtg security update Red Hat Security Advisories (RHSA) · Sep 9, 2026
- ALAS2-2026-3884 Important: mrtg security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 31, 2026
- RLSA-2026:57596 Important: mrtg security update Rocky Linux Security Advisories · Aug 21, 2026
- RLSA-2026:57600 Important: mrtg security update Rocky Linux Security Advisories · Aug 21, 2026
- ELSA-2026-57596 Important: mrtg security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 20, 2026
- ELSA-2026-57600 Important: mrtg security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 20, 2026
References
- RHSA-2026:57596 vendor-advisory
- RHSA-2026:57600 vendor-advisory
- RHSA-2026:65832 vendor-advisory
- RHSA-2026:87255 vendor-advisory
- RHSA-2026:91644 vendor-advisory
- RHSA-2026:91843 vendor-advisory
- RHSA-2026:91844 vendor-advisory
- RHSA-2026:91845 vendor-advisory
- RHSA-2026:92051 vendor-advisory
- RHSA-2026:92071 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-72694 vdb-entry
- RHBZ#2460973 issue-tracking