CVE-2026-109357: LibreNMS LDAP Auth Bypass Vulnerability

CVE-2026-109357 Overview

CVE-2026-109357 is an LDAP filter injection vulnerability in LibreNMS before version 26.9.0. The flaw affects the ldap-authorization and ad-authorization authentication modes. Usernames are inserted unescaped into Lightweight Directory Access Protocol (LDAP) search filters, and authentication only validates user existence. When REMOTE_USER is not forwarded by the web server, unauthenticated attackers can send a wildcard username through HTTP Basic Authorization (PHP_AUTH_USER). The injected wildcard matches every user and group in the directory, granting administrative access to the LibreNMS instance.

Critical Impact
Unauthenticated remote attackers can bypass authentication and obtain administrative access to LibreNMS by injecting an LDAP wildcard filter through the HTTP Authorization header.

Affected Products

LibreNMS versions prior to 26.9.0
Deployments configured with ldap-authorization mode
Deployments configured with ad-authorization mode

Discovery Timeline

2026-10-12 - CVE-2026-109357 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109357

Vulnerability Analysis

The vulnerability is classified as LDAP Injection under CWE-90. LibreNMS integrates with LDAP and Active Directory to authorize users against directory groups. In the affected authorization modes, the application builds LDAP search filters by concatenating the submitted username directly into the filter string. No escaping is performed on reserved LDAP metacharacters such as *, (, ), \, or null bytes.

The authentication layer treats a successful filter match as proof of identity. It does not verify a password binding against the matched distinguished name. Any filter that returns at least one directory entry is accepted as a valid login. This design decision converts a filter injection into a full authentication bypass.

Root Cause

Two defects combine to produce the vulnerability. First, the LDAP filter construction routine fails to apply RFC 4515 escaping to attacker-controlled input before inserting it into the search filter. Second, the authorization modes rely solely on a non-empty LDAP search result to establish identity, rather than performing a bind with the user's credentials.

Attack Vector

When a deployment does not forward the REMOTE_USER server variable, LibreNMS falls back to reading credentials from HTTP Basic Authorization. The web server populates PHP_AUTH_USER with the decoded username from the Authorization: Basic header. An attacker submits a request with a Base64-encoded header where the username is set to a wildcard such as *. The injected value expands the LDAP filter to match every object in the directory, including administrators, and the first matched user is granted a session with administrative privileges.

See the GitHub Security Advisory GHSA-7cmx-65c5-8h8v and the VulnCheck Advisory for LibreNMS LDAP Filter Injection for technical details.

Detection Methods for CVE-2026-109357

Indicators of Compromise

HTTP requests to LibreNMS containing an Authorization: Basic header where the decoded username is * or contains LDAP metacharacters such as (, ), |, or &
Successful web application sessions originating from unknown source addresses without a preceding interactive login flow
LDAP server search logs showing filters that resolve to broad wildcards against the user base distinguished name
New administrative actions in LibreNMS audit logs attributed to accounts that have never logged in previously

Detection Strategies

Inspect reverse proxy and web server logs for Basic Authorization values that decode to strings containing *, parentheses, or backslashes
Correlate LibreNMS login events with directory server search activity to identify filter patterns returning unusually large result sets
Alert on LibreNMS sessions where the authenticated username does not match any provisioned local account or expected directory principal

Monitoring Recommendations

Enable verbose LDAP query logging on the directory server for the service account used by LibreNMS
Forward LibreNMS web server access logs and application audit logs to a central analytics platform for retention and correlation
Monitor privileged configuration changes within LibreNMS, including device additions, user role modifications, and alert rule edits

How to Mitigate CVE-2026-109357

Immediate Actions Required

Upgrade LibreNMS to version 26.9.0 or later on all production and staging instances
Audit administrative accounts and active sessions for unauthorized logins since the vulnerability window began
Rotate the LDAP bind service account password used by LibreNMS and review its directory permissions
Restrict network access to the LibreNMS web interface to trusted management networks until patching is complete

Patch Information

The LibreNMS maintainers addressed CVE-2026-109357 in release 26.9.0. The fix escapes username input before it is placed into LDAP search filters and tightens the authorization flow. Administrators should apply the upstream release as published in the GitHub Security Advisory GHSA-7cmx-65c5-8h8v.

Workarounds

Configure the web server to always set REMOTE_USER from an authenticated upstream identity provider, preventing fallback to PHP_AUTH_USER
Disable ldap-authorization and ad-authorization modes and migrate to an authentication backend that performs a credentialed LDAP bind
Deploy a web application firewall rule that blocks Authorization: Basic headers whose decoded username contains LDAP metacharacters
Enforce source-IP allowlists on the LibreNMS virtual host at the reverse proxy layer

bash

# Example WAF-style rule to block wildcard usernames in Basic Auth
# ModSecurity-style pseudocode
SecRule REQUEST_HEADERS:Authorization "@rx ^Basic\s+[A-Za-z0-9+/=]+$" \
  "phase:1,chain,deny,status:400,id:1092026,\
   msg:'LDAP metacharacter in Basic Auth username (CVE-2026-109357)'"
  SecRule REQUEST_HEADERS:Authorization "@rx [*()\\|&]" \
    "t:base64Decode"