CVE-2026-86427: LibreNMS before 26.8.0 Argument Injection via graph_title
LibreNMS before 26.8.0 contains an argument injection vulnerability in the graphtitle parameter that allows authenticated attackers to inject arbitrary rrdtool arguments by breaking out of double-quote escaping. Attackers can inject DEF and LINE arguments to read RRD files from unauthorized devices, or use newline injection to execute arbitrary rrdtool commands, bypassing per-device authorization checks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to LibreNMS. The provided information does not identify any additional privilege level or role requirement beyond authenticated access.
What access can an attacker gain through exploitation?
An attacker can inject rrdtool DEF and LINE arguments to read RRD files associated with devices they are not authorized to access. Newline injection can also be used to execute arbitrary rrdtool commands, bypassing per-device authorization checks.
Which deployments are affected?
LibreNMS versions before 26.8.0 are affected. The vulnerability is reachable through the graph_title parameter.