CVE-2026-67436

Name of the Vulnerable Software and Affected Versions Linuxfabrik monitoring-plugins versions 6.0.0 and earlier

Description The redfish-* plugins build request URLs by concatenating an operator-supplied base URL with @odata.id links provided in the response. This behavior allows a malicious or compromised Baseboard Management Controller (BMC) to redirect authenticated Redfish requests, potentially leading to the disclosure of X-Auth-Token or HTTP Basic credentials.

Recommendations Update Linuxfabrik monitoring-plugins to a version later than 6.0.0.