CVE-2026-108715: LibreNMS Authorization Bypass Vulnerability

CVE-2026-108715 Overview

CVE-2026-108715 is an authorization bypass vulnerability in LibreNMS through version 26.9.1.1. The flaw resides in includes/html/graphs/smokeping/auth.inc.php, where the authorization check validates the source (src) probe device instead of the rendered target device. Restricted users who have been granted access to a probe device can request smokeping_in or smokeping_out graphs with arbitrary device IDs. This allows them to view latency data and enumerate device names across the LibreNMS deployment, exposing network topology information they should not be able to access.

Critical Impact

Authenticated low-privilege users can enumerate device names and read Smokeping latency data for devices outside their authorized scope, resulting in confidentiality loss across the monitored network inventory.

Affected Products

• LibreNMS network monitoring platform
• All versions through 26.9.1.1
• Deployments using Smokeping integration for latency graphing

Discovery Timeline

• 2026-10-11 - CVE-2026-108715 published to NVD
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-108715

Vulnerability Analysis

The vulnerability is categorized under [CWE-639]: Authorization Bypass Through User-Controlled Key. LibreNMS uses per-device permissions to restrict which users can view monitoring data for specific devices. The Smokeping graph rendering flow accepts both a source probe device and a target device identifier when generating latency graphs. The authorization logic in auth.inc.php only verifies permissions against the probe (src) device, not the target device whose latency data is actually rendered.

An attacker with legitimate access to any probe device can supply arbitrary target device IDs in Smokeping graph requests. The server returns the requested graph without validating whether the user is authorized to view the target. This exposes device names and latency measurements for devices across the entire LibreNMS inventory.

Root Cause

The root cause is a device-identity confusion in the authorization logic at includes/html/graphs/smokeping/auth.inc.php. The check validates src instead of the device being rendered. Review the relevant code at the GitHub Smokeping Auth Code and the graph utility logic at LibreNMS Graph Utility.

Attack Vector

Exploitation requires authenticated access as a restricted user who has been granted permission on at least one probe device. The attacker crafts an HTTP request to the LibreNMS Smokeping graph endpoint, specifying their authorized probe as the src parameter and an arbitrary device identifier as the target. By iterating through device IDs, the attacker enumerates device names and harvests latency telemetry for unauthorized targets. See the HackMD Smokeping Configuration Analysis and the VulnCheck Advisory on LibreNMS for detailed exploitation context. No code example is provided because no verified proof-of-concept is published.

Detection Methods for CVE-2026-108715

Indicators of Compromise

• Web server access logs showing repeated requests to Smokeping graph endpoints with varying target device IDs from a single authenticated session.
• Requests to smokeping_in or smokeping_out graph types where the authenticated user has probe-only permissions.
• Sequential or scripted enumeration patterns against device ID parameters in Smokeping graph URLs.

Detection Strategies

• Correlate LibreNMS user permission mappings against accessed device IDs in web logs to identify out-of-scope access.
• Alert on high-volume Smokeping graph requests from accounts flagged as restricted or probe-only.
• Monitor for user agents or request cadences consistent with automated enumeration tooling.

Monitoring Recommendations

• Forward LibreNMS and web server logs to a centralized analytics platform for authorization anomaly detection.
• Baseline normal Smokeping query volumes per user role and alert on deviations.
• Review LibreNMS audit trails periodically for restricted users accessing graph endpoints tied to devices outside their assigned scope.

How to Mitigate CVE-2026-108715

Immediate Actions Required

• Upgrade LibreNMS to a version released after 26.9.1.1 once a patched release is available from the LibreNMS Repository.
• Audit user accounts with restricted or probe-only roles and reduce their permissions to the minimum required.
• Review historical web logs for Smokeping graph requests that may indicate prior enumeration of unauthorized devices.

Patch Information

Monitor the LibreNMS GitHub repository and the VulnCheck Advisory on LibreNMS for the fixed release. The remediation must modify includes/html/graphs/smokeping/auth.inc.php to authorize against the rendered target device rather than the src probe device.

Workarounds

• Disable the Smokeping integration in LibreNMS if latency graphing is not operationally required.
• Restrict HTTP access to Smokeping graph endpoints at the reverse proxy layer until the upstream fix is deployed.
• Remove probe-device permissions from accounts that do not require Smokeping visibility, limiting the pool of users capable of exploiting the flaw.

# Example: block Smokeping graph endpoints at an nginx reverse proxy
location ~ ^/graph.php {
    if ($arg_type ~* "^smokeping_(in|out)$") {
        return 403;
    }
}