CVE-2026-109353: LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php
LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notificationid parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in notificationsattribs and readable through the interface.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated unprivileged LibreNMS user can exploit it. The attack is network-accessible and does not require user interaction.
What data could be exposed?
An attacker can perform cross-table reads, including reading password hashes from the users table. Query results can be persisted in notifications_attribs and then read through the LibreNMS interface.
Which deployments should be considered affected?
LibreNMS versions before 26.9.0 should be considered affected. The vulnerable input is the notification_id parameter handled by notifications.inc.php, specifically when supplied as an array-valued parameter.
How can I tell whether exploitation may have occurred?
Review notifications_attribs for unexpected stored values and inspect notification-related activity for array-valued notification_id requests. Because results can be made readable through the interface, investigate unusual notification attribute content and access patterns.