CVE-2026-109353
Received Received - Intake

SQL Injection in LibreNMS Prior to 26.9.0

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in notifications_attribs and readable through the interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109353
EUVD
EUVD-2026-97655

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
librenms librenms 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109353 is a high-severity SQL injection vulnerability in LibreNMS, a network monitoring tool. The issue occurs in the notifications.inc.php file where an unprivileged user can inject malicious SQL via an array-valued notification_id parameter. This allows any ordinary account to execute arbitrary SQL queries, including reading sensitive data like password hashes from the users table. The injected payload is stored in the notifications_attribs table, making the attack non-blind as results can be retrieved directly.

Detection Guidance

To detect this vulnerability, inspect the notifications.inc.php file for improper handling of array inputs in the notification_id parameter. Check for suspicious SQL queries in logs or database tables like notifications_attribs that may indicate exploitation attempts.

Impact Analysis

This vulnerability allows attackers to read sensitive data such as user password hashes from the database without needing administrative privileges. The attack can be performed remotely over the network and does not require user interaction. If exploited, it could lead to unauthorized access to systems, data breaches, and potential further compromise of the network monitoring environment.

Compliance Impact

This vulnerability could lead to violations of GDPR and HIPAA due to unauthorized access to sensitive personal data such as user credentials. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, fines, and reputational damage for organizations failing to secure their systems.

Mitigation Strategies

Upgrade LibreNMS to version 26.9.0 or later immediately. If upgrading is not possible, restrict access to the notifications.inc.php endpoint and monitor database activity for unauthorized queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109353. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart