CVE-2026-109353: LibreNMS SQL Injection Vulnerability

CVE-2026-109353 Overview

CVE-2026-109353 is a SQL injection vulnerability [CWE-89] in LibreNMS versions before 26.9.0. The flaw resides in notifications.inc.php, where the notification_id parameter accepts array-valued input without proper sanitization. Unprivileged authenticated users can inject SQL statements to perform cross-table reads against sensitive data, including users.password hashes. Injected query results persist in the notifications_attribs table and become readable through the LibreNMS web interface, giving attackers a reliable data exfiltration channel. LibreNMS is a widely deployed open-source network monitoring platform, making this issue relevant for organizations that expose the application to internal users or multi-tenant environments.

Critical Impact
Authenticated low-privilege attackers can extract password hashes and other sensitive database contents through SQL injection, enabling credential theft and lateral movement.

Affected Products

LibreNMS versions prior to 26.9.0
Deployments exposing notifications.inc.php to authenticated users
Multi-tenant LibreNMS installations with low-privilege user accounts

Discovery Timeline

2026-10-12 - CVE-2026-109353 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109353

Vulnerability Analysis

The vulnerability exists in LibreNMS notifications.inc.php, which handles notification identifiers submitted through HTTP requests. The handler expects a scalar notification_id value but fails to validate the parameter type. When an attacker supplies an array instead of a string or integer, the backend concatenates array elements into a SQL statement without proper parameterization or type coercion.

This construction creates a classic second-order SQL injection pattern. The attacker-controlled query executes against the LibreNMS database with the privileges of the application database user. Results are written into the notifications_attribs table, which the application then renders back to the attacker through standard notification views.

Because the injected results persist in storage and surface through the user interface, attackers do not need blind, time-based, or error-based extraction techniques. Direct cross-table reads against users.password yield credential hashes suitable for offline cracking.

Root Cause

The root cause is improper input validation and unsafe SQL construction in the notifications component. The code assumes notification_id is a single value and does not reject or sanitize array inputs. The resulting query is built via string concatenation rather than prepared statements with bound parameters, violating standard protections against [CWE-89] SQL injection.

Attack Vector

Exploitation requires network access to the LibreNMS web interface and low-privilege authenticated credentials. The attacker submits a crafted POST or GET request to notifications.inc.php with notification_id supplied as an array. The injected SQL executes server-side and the results populate attacker-readable notification attributes. Full technical analysis is available in the GitHub Security Advisory GHSA-2pw7-8mmj-gcw5 and the VulnCheck Advisory for LibreNMS.

Detection Methods for CVE-2026-109353

Indicators of Compromise

HTTP requests to notifications.inc.php containing notification_id[] array parameters or bracketed index notation
Unexpected entries in the notifications_attribs table referencing columns such as password, users, or auth_level
Database query logs showing SELECT statements that join or reference users table columns from the notifications context
Successful authentications from accounts shortly after suspicious notification parameter activity, indicating cracked credentials in use

Detection Strategies

Monitor web server access logs for requests to notifications.inc.php where the notification_id parameter is passed as an array rather than a scalar
Enable MySQL or MariaDB general query logging and alert on queries from the LibreNMS user that reference the users table outside expected code paths
Review notifications_attribs content for values that resemble bcrypt, SHA, or other password hash formats

Monitoring Recommendations

Audit LibreNMS user accounts and remove unused low-privilege accounts that could serve as exploitation footholds
Forward LibreNMS application logs and database audit logs to a centralized SIEM for correlation with authentication events
Baseline normal notification query patterns and alert on deviations in column selection or table joins

How to Mitigate CVE-2026-109353

Immediate Actions Required

Upgrade LibreNMS to version 26.9.0 or later, which contains the official fix
Rotate all LibreNMS user passwords and force reauthentication after patching
Rotate the database account credentials used by LibreNMS if exploitation is suspected
Review notifications_attribs for exfiltrated data and purge any records containing credential material

Patch Information

The LibreNMS maintainers addressed CVE-2026-109353 in release 26.9.0. The fix enforces scalar type validation for notification_id and uses parameterized queries in the notifications component. Patch details and commit references are documented in GitHub Security Advisory GHSA-2pw7-8mmj-gcw5.

Workarounds

Restrict access to the LibreNMS web interface using network ACLs or VPN gating until the upgrade is deployed
Disable or remove low-privilege user accounts that do not require access to the notifications feature
Place a web application firewall rule in front of LibreNMS to block requests where notification_id is submitted as an array

bash

# Example WAF rule concept to block array-valued notification_id parameters
# ModSecurity rule
SecRule ARGS_NAMES "@rx ^notification_id\[" \
  "id:1026109353,phase:2,deny,status:400,\
   msg:'CVE-2026-109353 - LibreNMS notification_id array injection attempt'"