All vulnerabilities
CVE-2026-109357GHSA-7cmx-65c5-8h8v

LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header

librenms librenms
Open in ThreatlineRecord JSON
CVSS
9.2Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 15 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.46%Chance of exploitation activity in the next 30 days, higher than 38% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in26.9.0Fixed versionCVE List
Published12 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTE_USER is not forwarded, unauthenticated attackers can send a wildcard username via HTTP Basic Authorization (PHP_AUTH_USER) to match all users and groups and gain admin access.

Text from CVE List

Affected versions 2

  • librenmsaffected: all versions before 26.9.0CVE List
  • librenmsunaffected: 26.9.0CVE List

References 2