A newly disclosed flaw, CVE-2026-125357, affects the munin-httpd component of the Munin monitoring tool in versions 2.99.1 through 2.999.18. Its static file handler fails to properly block directory traversal, letting an attacker craft a request that slips past the sanitization check and reads files such as munin.conf, potentially exposing credentials for monitored services. No authentication is required to exploit the flaw.
// source: nvd.nist.gov ↗