CVE-2026-2751: Centreon Web Blind SQLi Vulnerability

CVE-2026-2751 Overview

A Blind SQL Injection vulnerability has been identified in Centreon Web affecting the Service Dependencies module on Central Server deployments running on Linux. The vulnerability exists due to unsanitized array keys in the Service Dependencies deletion functionality, allowing authenticated attackers to inject malicious SQL queries through network-accessible endpoints.

Critical Impact

Authenticated attackers can exploit this blind SQL injection vulnerability to extract sensitive data from the database, modify database contents, and potentially achieve limited denial of service against the Centreon monitoring infrastructure.

Affected Products

• Centreon Web on Central Server versions before 25.10.8
• Centreon Web on Central Server versions before 24.10.20
• Centreon Web on Central Server versions before 24.04.24

Discovery Timeline

• 2026-02-27 - CVE CVE-2026-2751 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-2751

Vulnerability Analysis

This vulnerability (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) resides in the Service Dependencies module of Centreon Web. The application fails to properly sanitize array keys when processing deletion requests for service dependencies. When an authenticated user submits a deletion request, the application directly incorporates user-supplied array key values into SQL queries without adequate input validation or parameterization.

The blind nature of this SQL injection means that while the attacker does not receive direct query results in the application response, they can infer database contents through boolean-based or time-based techniques. By crafting specific payloads in the array keys, an attacker can systematically extract database information, including potentially sensitive configuration data, credentials, and monitoring infrastructure details.

Root Cause

The root cause of this vulnerability is inadequate input validation and improper handling of user-supplied array keys in the Service Dependencies deletion functionality. The application treats array keys as trusted input and directly concatenates them into SQL queries rather than using parameterized queries or prepared statements. This allows attackers to inject arbitrary SQL syntax through specially crafted array key names.

Attack Vector

The attack vector is network-based, requiring low-privileged authentication to the Centreon Web interface. An attacker with valid credentials to the Central Server can exploit this vulnerability by sending a crafted HTTP request to the Service Dependencies deletion endpoint. The malicious payload is embedded within the array keys of the deletion request parameters. Since the vulnerability is a blind SQL injection, the attacker uses inference techniques—such as observing response time differences or conditional application behavior—to extract database information character by character.

The vulnerability manifests in the Service Dependencies deletion functionality where array keys are passed directly to SQL queries without sanitization. Attackers can inject SQL commands through specially crafted array key names in deletion requests. For detailed technical information, refer to the Centreon Security Bulletin for CVE-2026-2751.

Detection Methods for CVE-2026-2751

Indicators of Compromise

• Unusual HTTP requests to Service Dependencies deletion endpoints containing SQL-like syntax in parameter keys
• Increased database query execution times indicating time-based blind SQL injection attempts
• Abnormal patterns in web server access logs showing repeated requests with incrementally modified payloads
• Database audit logs showing unexpected query patterns or unauthorized data access attempts

Detection Strategies

• Monitor web application firewall (WAF) logs for SQL injection patterns targeting the Service Dependencies module
• Implement database activity monitoring to detect anomalous query patterns or unusual data extraction operations
• Configure intrusion detection systems (IDS) to alert on blind SQL injection attack signatures
• Review Centreon Web access logs for suspicious deletion requests with malformed or encoded array keys

Monitoring Recommendations

• Enable detailed logging for all Service Dependencies module operations
• Implement real-time alerting on database query anomalies and extended execution times
• Deploy SentinelOne Singularity to monitor for post-exploitation activities following successful SQL injection
• Correlate authentication logs with Service Dependencies module activity to identify compromised accounts

How to Mitigate CVE-2026-2751

Immediate Actions Required

• Upgrade Centreon Web to version 25.10.8, 24.10.20, or 24.04.24 or later immediately
• Restrict network access to the Centreon Web interface to trusted IP addresses only
• Review database access logs for indicators of prior exploitation
• Audit user accounts with access to Service Dependencies functionality and rotate credentials as a precaution

Patch Information

Centreon has released security updates that address this vulnerability. Organizations should upgrade to the following patched versions:

• Version 25.10.x: Upgrade to 25.10.8 or later
• Version 24.10.x: Upgrade to 24.10.20 or later
• Version 24.04.x: Upgrade to 24.04.24 or later

Review the Centreon Security Bulletin for CVE-2026-2751 for complete patch details and upgrade instructions.

Workarounds

• Implement a web application firewall (WAF) with SQL injection detection rules in front of Centreon Web
• Restrict access to the Service Dependencies module to essential administrators only
• Enable network segmentation to limit exposure of the Central Server from untrusted networks
• Configure database permissions to minimize the impact of potential SQL injection exploitation

# Example: Restrict access to Centreon Web via iptables
# Limit access to trusted management networks only
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Enable audit logging for Apache/Nginx to detect exploitation attempts
# Apache example - add to httpd.conf or virtual host
# LogLevel info
# CustomLog /var/log/httpd/centreon_access.log combined