CVE-2026-86091: ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ntopngto a version that resolves this vulnerability.Fixed in 6.7.260717 - Compensating control
Restrict access to the ntopng pools bulk-delete/delete pools endpoint so only administrators can reach it (e.g., via network ACL/firewall rules limiting who can POST to the endpoint).
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated ntopng user who is not an administrator may be able to exploit it. The attacker needs network access to the ntopng interface and valid low-privilege credentials; no user interaction is required.
Are default deployments affected?
The provided information does not identify a configuration prerequisite beyond the presence of the vulnerable bulk-delete endpoint and an authenticated non-administrator account. Deployments running ntopng before 6.7.260717 should be considered affected.
What is the impact of a successful attack?
An attacker can delete all host pools and their member bindings through POST requests to the pools bulk-delete endpoint. This can irreversibly remove traffic-policy bindings and visibility restrictions, potentially bypassing security policies.
What can be done if upgrading is not immediately possible?
Restrict access to the ntopng interface and limit or disable non-administrator accounts where operationally possible. Monitor or block POST requests to the pools bulk-delete endpoint until the affected installation can be updated.