The redfish-* plugins build request URLs by concatenating a base URL supplied by the operator with an @odata.id link supplied by the BMC. This lack of validation permits an attacker who can influence a malicious or compromised BMC to redirect the plugin to arbitrary destinations. When the plugin follows the redirect it can expose the X‑Auth‑Token or HTTP Basic credentials that it previously transmitted to what it thought was the legitimate BMC. Consequently, an attacker who can inject a crafted @odata.id value or otherwise attain communication with the monitoring host can harvest privileged credentials that grant broad access to the network or to hosted services.

Linuxfabrik monitoring‑plugins, version 6.0.0 and earlier, the set of Python plugins used by Icinga, Nagios, and related systems that call Redfish APIs through the redfish-* modules.

The CVSS score of 8.3 signals high severity; the EPSS score is less than 1%, indicating exploitation is currently rare, and the V is not on CISA KEV, so new deployments remain at risk. The likely attack vector is remote: an attacker who can influence the BMC or intercept traffic between the monitoring host and the BMC can redirect requests, harvest credentials, and potentially gain further access. The exploitation requires only that the monitoring host communicates with a BMC; no additional privileged access is needed beyond the normal monitoring operation.