CVE-2026-86426: LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion
LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to match token hashes, gaining access to API functionality including device credentials and administrative features that enable remote code execution through alert templates.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LibreNMSto a version that resolves this vulnerability.Fixed in 26.8.0
Event History
Frequently Asked Questions
Which deployments are exposed?
LibreNMS installations running versions before 26.8.0 are affected where the REST API is reachable by an attacker. The issue concerns authentication for protected REST API endpoints.
What does an attacker need to exploit this?
The attacker does not need a valid API token or prior authentication. Exploitation uses numeric values, such as small integers from 0 through 9, in place of string tokens to trigger MySQL type coercion.
What access could exploitation provide?
An attacker can access protected API functionality, including device credentials and administrative features. The described administrative functionality can enable remote code execution through alert templates.
How can I determine whether mitigation is required?
Identify the LibreNMS version in use and whether its REST API can be reached by untrusted users or networks. Instances before 26.8.0 should be treated as requiring remediation.