The command history was clean. The processes looked normal. No strange binaries in /tmp. But the privilege escalation had already happened — and the trail led straight through lnav.
lnav is a powerful log file navigator. It reads system logs, parses them, and gives you clean queries right in the terminal. It’s loved for quick incident response and debugging. But like many powerful tools, the wrong configuration or unsafe environment turns it into a path for unplanned root access.
Privilege escalation with lnav often happens when it is run with elevated privileges in a shared environment. If the configurations allow reading from arbitrary files or executing embedded scripts, the boundary between normal user and root crumbles. Even well-meaning deployments can create unsafe gaps. Using unsafe plugins, processing untrusted log data, or mixing roles in a single machine sets the stage.
The risk profile increases when lnav runs with sudo by default, when shell escapes are not disabled, or when plugins are installed system-wide from unverified sources. The core of the vulnerability usually comes from trusting the input — log files can contain malicious payloads if ingested without careful filters. From there, injected commands might launch, environment variables can be overridden, and the jump to root can happen with surprising speed.