CVE-2026-109357: LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header
LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcard username via HTTP Basic Authorization (PHPAUTHUSER) to match all users and groups and gain admin access.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
LibreNMS deployments using ldap-authorization or ad-authorization modes are exposed when REMOTE_USER is not forwarded. In that condition, an unauthenticated remote attacker can supply a username through the HTTP Basic Authorization header.
What does an attacker need to send to exploit the issue?
The attacker needs to provide a wildcard username as PHP_AUTH_USER via HTTP Basic Authorization. The vulnerable LDAP search inserts that username into the filter without escaping, allowing it to match users and groups.
What level of access can exploitation provide?
Successful exploitation can result in administrator access. The affected authentication logic checks only for user existence, enabling the authentication bypass when the wildcard matches.
What mitigation is available if upgrading cannot happen immediately?
Ensure REMOTE_USER is forwarded so authentication does not rely on the attacker-controlled PHP_AUTH_USER value from HTTP Basic Authorization. This specifically addresses the described unauthenticated attack path.