CVE-2026-26990: LibreNMS SQL Injection Vulnerability

CVE-2026-26990 Overview

CVE-2026-26990 is a time-based blind SQL injection vulnerability in LibreNMS, an auto-discovering PHP/MySQL/SNMP network monitoring tool. The flaw resides in address-search.inc.php, where the address parameter is concatenated directly into an SQL query without parameter binding. Any authenticated user can supply a crafted subnet prefix to manipulate query logic and extract database contents through time-based conditional responses. The vulnerability affects LibreNMS versions 25.12.0 and earlier, and the issue is fixed in version 26.2.0. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Authenticated attackers can infer database contents, including credentials and monitoring configuration data, through blind SQL injection across the network attack vector.

Affected Products

• LibreNMS versions 25.12.0 and earlier
• LibreNMS address-search.inc.php component
• Fixed in LibreNMS version 26.2.0

Discovery Timeline

• 2026-02-20 - CVE-2026-26990 published to NVD
• 2026-02-20 - Last updated in NVD database

Technical Details for CVE-2026-26990

Vulnerability Analysis

The vulnerability stems from unsafe SQL query construction within address-search.inc.php. When the application processes the address request parameter, it parses a subnet prefix value and concatenates that value directly into a SQL statement. The query executes without prepared statements or parameterized binding, leaving the input under attacker control.

An authenticated attacker submits a crafted prefix that contains SQL syntax, including conditional expressions paired with functions such as SLEEP() or BENCHMARK(). The database server pauses execution when the injected condition evaluates true, producing a measurable delay in the HTTP response. By varying the injected condition across requests, the attacker extracts data one bit at a time.

LibreNMS stores SNMP credentials, device inventory, alert rules, and user authentication data. Successful exploitation can disclose this information and provide pivoting opportunities into monitored network infrastructure.

Root Cause

The root cause is direct string concatenation of user-supplied input into a SQL query. The vulnerable code path accepts the address parameter, derives the prefix component, and inserts it into the query body without escaping or binding. The fix in commit 15429580baba03ed1dd377bada1bde4b7a1175a1 replaces the unsafe concatenation with proper parameterized handling. Review the GitHub Commit Fix and GitHub Security Advisory GHSA-79q9-wc6p-cf92 for technical details.

Attack Vector

Exploitation requires valid LibreNMS authentication and network access to the web interface. The attacker submits HTTP requests to the address search endpoint with the address parameter containing the injected payload. No user interaction or elevated privileges are required beyond an authenticated account. Because LibreNMS is commonly deployed in operations networks with broad internal access, low-privilege monitoring users may be sufficient to compromise the database.

No proof-of-concept code is available in public references. The vulnerability mechanism is documented in the GitHub Pull Request.

Detection Methods for CVE-2026-26990

Indicators of Compromise

• HTTP requests to LibreNMS endpoints containing the address parameter with SQL keywords such as SLEEP, BENCHMARK, IF, CASE, or UNION
• Anomalous response times on address search requests, particularly delays in multiples of seconds
• MySQL slow query log entries showing long-running queries originating from the LibreNMS address search code path
• Repeated authenticated requests from a single session enumerating database structures byte by byte

Detection Strategies

• Inspect web server access logs for address-search.inc.php requests containing SQL syntax tokens in the address query parameter
• Correlate authenticated LibreNMS session activity with database query duration spikes
• Apply WAF or reverse proxy signatures targeting time-based blind SQL injection patterns against the LibreNMS web tier
• Audit LibreNMS user accounts for unexpected access patterns or session activity from unusual source addresses

Monitoring Recommendations

• Enable MySQL general query logging or slow query logging on the LibreNMS database during investigation windows
• Alert on HTTP request latency outliers on the LibreNMS address search route
• Forward LibreNMS web server, application, and database logs to a centralized analytics platform for correlation
• Track failed and successful authentication events to identify low-privilege accounts performing reconnaissance

How to Mitigate CVE-2026-26990

Immediate Actions Required

• Upgrade LibreNMS to version 26.2.0 or later, which contains the fix from commit 15429580baba03ed1dd377bada1bde4b7a1175a1
• Audit existing LibreNMS user accounts and remove unused or dormant credentials
• Rotate SNMP community strings and device credentials stored in LibreNMS if compromise is suspected
• Review web server and database logs for prior exploitation attempts referencing the address parameter

Patch Information

The vendor fix is available in LibreNMS 26.2.0. The patch replaces unsafe string concatenation with parameterized SQL binding in address-search.inc.php. Administrators should apply the upgrade through standard LibreNMS update procedures documented at the GitHub Security Advisory GHSA-79q9-wc6p-cf92.

Workarounds

• Restrict access to the LibreNMS web interface to trusted management networks using firewall or reverse proxy rules
• Enforce strong authentication and minimize the number of accounts with access to LibreNMS
• Deploy a web application firewall rule that blocks SQL syntax tokens in the address parameter until patching is complete
• Place the LibreNMS database behind strict network segmentation to limit lateral access if data is disclosed

# Configuration example: upgrade LibreNMS to the patched release
cd /opt/librenms
sudo -u librenms git fetch --tags
sudo -u librenms git checkout 26.2.0
sudo -u librenms ./daily.sh
sudo systemctl restart php-fpm nginx