Version 3.0.3 (Gabriele Tergit) Released
Lorenz Kästle, August 7, 2026
The Monitoring Plugins Development Team announces version 3.0.3
of the Monitoring Plugins.
This is a security release which fixes a vulnerability in check_mailq and some "normal"
bugs.
This release contains a fix for a security vulnerability regarding check_mailq.
Technically we do not introduce the security problem, but strongly lead people
to create one.
check_mailq could be used with the sudo option (-s/--sudo) and would execute
sudo then with mailq as an argument AND additional arbitrary arguments given by the user.
A simple sudo rule to allow the monitoring user to execute this, could lead to arbitrary
command execution with root privileges.
The patch with this release disables the whole sudo option of check_mailq.
Allowing the monitoring user to view the mail queue is now a problem of the MTA and
most (hopefully all) MTAs should support this in one way or another.
We thank Christopher Kreft (again) for reporting the problem.
Other changes
- check_smtp:
- Trying to use authentication resulted in an UNKNOWN state if the authentication succeeded. It returns OK again now.
- The port logic in SMTP was a bit broken. When the order of cli parameters was wrong, the wrong port was used for either direct TLS or STARTTLS when using the certificate lifetime option (-D). The default port is now directly taken from --ssl/--starttls and one of these has to be selected explicitly.
- check_swap
- On FreeBSD information about swap usage was not detected correctly (it was assumed that swap was disabled). It should work now as expected again.
- check_snmp:
- On Gentoo builds would fail to due a certain net-snmp configuration. This should be fixed and check_snmp offers the options which net-snmp on that system has
- SNMPv3 authentication and privacy was broken since 3.0.0 This should be fixed now.
- check_ups
- Since 3.0.0 there were some new bugs which reduced the utility significantly. Those were fixed.
The codename for this release is "Gabriele Tergit".
You can get the tarball from our download page.