CVE-2026-86426
Received Received - Intake

Authentication Bypass in LibreNMS REST API via MySQL Type Coercion

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description
LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to match token hashes, gaining access to API functionality including device credentials and administrative features that enable remote code execution through alert templates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86426
EUVD
EUVD-2026-72384

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
librenms librenms to 26.8.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86426 is an authentication bypass vulnerability in LibreNMS versions before 26.8.0. It allows unauthenticated attackers to access protected REST API endpoints by sending numeric values like 0 through 9 instead of valid string tokens. This works due to MySQL type coercion, where numeric inputs match token hashes starting with those numbers, bypassing authentication entirely.

Detection Guidance

To detect this vulnerability, check LibreNMS versions before 26.8.0. Inspect API logs for repeated numeric token attempts (0-9) or failed authentication bypass attempts. Use commands like 'curl -X GET http://<librenms-server>/api/v0/devices' with numeric values to test for access. Monitor for unauthorized administrative actions or data exfiltration via API endpoints.

Impact Analysis

If exploited, attackers can gain access to sensitive API functionality, including device credentials and administrative features. If an admin token is matched, remote code execution (RCE) is possible through alert templates. The vulnerability requires at least one enabled API token to exist on the system and can be exploited without rate limiting.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Unrestricted API access may result in data breaches, exposing personal or health information, and failing compliance audits due to inadequate access controls.

Mitigation Strategies

Immediately upgrade LibreNMS to version 26.8.0 or later. Disable all API tokens temporarily if possible. Review and revoke any tokens that may have been exposed. Implement rate limiting on API endpoints. Monitor for suspicious activity and unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86426. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart