CVE-2026-109356: LibreNMS Authorization Bypass Vulnerability

CVE-2026-109356 Overview

CVE-2026-109356 is a missing authorization vulnerability [CWE-862] in LibreNMS versions before 26.9.0. The flaw resides in the PortsController::purge method, which fails to verify delete privileges before processing requests. Users holding only global-read permissions can issue DELETE requests to the /ports/purge endpoint and permanently remove port records. Supplying the purge=all parameter irreversibly erases every deleted port across all devices visible to the authenticated account. The vulnerability affects data integrity in network monitoring environments where read-only accounts are commonly provisioned for operators, auditors, and automation.

Critical Impact

Authenticated users with read-only access can permanently delete port records across all visible devices, destroying historical monitoring data without authorization.

Affected Products

• LibreNMS versions prior to 26.9.0
• Deployments exposing the /ports/purge API endpoint
• Instances with global-read users or shared read-only API tokens

Discovery Timeline

• 2026-10-12 - CVE-2026-109356 published to NVD
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109356

Vulnerability Analysis

LibreNMS is an open-source network monitoring platform that tracks interface state, traffic counters, and device inventory. The PortsController::purge action is designed to permanently remove port records previously marked as deleted. In versions before 26.9.0, the controller omits an authorization check that validates whether the requesting user holds delete privileges on the targeted ports.

The missing check allows any authenticated session with global-read scope to invoke the purge operation. Because LibreNMS retains deleted ports as soft-deleted rows to preserve historical graphs and metrics, the purge endpoint is intentionally destructive. The absence of role enforcement converts a privileged administrative operation into an action available to the lowest-privilege authenticated role.

Root Cause

The root cause is a missing authorization guard in the PortsController::purge handler. The method validates authentication but does not enforce the delete capability associated with port management. This is a classic [CWE-862] Missing Authorization pattern, where the application assumes any user who reaches the endpoint is entitled to perform the action.

Attack Vector

Exploitation requires network access to the LibreNMS web interface or API and valid credentials for a global-read account. The attacker sends a DELETE request to /ports/purge, optionally including purge=all to target every soft-deleted port on all devices the account can view. The server processes the request and removes the corresponding database records without a privilege check. The impact is limited to integrity loss of port history and configuration state; confidentiality and availability of the LibreNMS service itself are not directly affected.

See the GitHub Security Advisory GHSA-9qcg-rgg9-mpjg and the VulnCheck advisory for additional technical context.

Detection Methods for CVE-2026-109356

Indicators of Compromise

• HTTP DELETE requests to /ports/purge originating from accounts without administrative roles.
• Requests containing the query or body parameter purge=all in web server access logs.
• Sudden drops in the count of soft-deleted port rows in the ports database table.
• Gaps in historical port metrics or missing interfaces in monitoring dashboards.

Detection Strategies

• Review web server and application logs for DELETE verbs targeting /ports/purge and correlate with the user identifier or API token used.
• Compare database row counts for deleted ports against prior baselines to identify mass deletions.
• Alert on API token activity that deviates from historical patterns, particularly tokens issued for read-only integrations.

Monitoring Recommendations

• Enable verbose audit logging on the LibreNMS API and forward events to a central log store for retention.
• Monitor authentication events for global-read accounts that initiate state-changing HTTP methods such as DELETE, POST, or PUT.
• Track administrative endpoint usage per user role and flag privilege boundary violations.

How to Mitigate CVE-2026-109356

Immediate Actions Required

• Upgrade LibreNMS to version 26.9.0 or later, which adds the missing authorization check to PortsController::purge.
• Audit all user accounts and API tokens with global-read access and rotate credentials for any suspect tokens.
• Review recent DELETE requests to /ports/purge and restore any port records removed without authorization from backups.

Patch Information

The LibreNMS maintainers resolved the issue in release 26.9.0. The fix enforces delete-privilege validation inside PortsController::purge before any port removal is executed. Refer to the GitHub Security Advisory GHSA-9qcg-rgg9-mpjg for commit details and release notes.

Workarounds

• Restrict access to the /ports/purge endpoint at a reverse proxy or web application firewall until the upgrade is applied.
• Temporarily remove or downgrade global-read users that do not require interactive access to the LibreNMS web interface.
• Enforce network-level access controls so only administrative workstations can reach the LibreNMS management interface.

# Example nginx snippet to block the vulnerable endpoint pre-patch
location = /ports/purge {
    return 403;
}