CVE-2026-83621: ntopng Authentication Bypass Vulnerability

CVE-2026-83621 Overview

ntopng is a web-based network traffic monitoring application widely deployed for real-time flow analysis and threat detection. CVE-2026-83621 is a missing authorization vulnerability [CWE-862] in the POST /lua/rest/v2/edit/system/edit_blacklist.lua REST endpoint. The endpoint fails to verify administrator privileges before invoking lists_utils.editList. Any authenticated non-admin user can modify blocklist configuration, redirect threat-intelligence downloads to attacker-controlled URLs, disable existing blocklists, or suppress scheduled updates. The malicious changes persist through Redis and are reloaded without any lower-level authorization guard. The issue is fixed in ntopng version 6.7.260717.

Critical Impact

A low-privileged authenticated user can subvert ntopng's threat-intelligence pipeline by pointing blocklist downloads to attacker-controlled content or disabling protective feeds entirely.

Affected Products

• ntopng versions prior to 6.7.260717
• Deployments exposing the edit_blacklist.lua REST endpoint to non-admin authenticated users
• Environments relying on ntopng-managed blocklists for network threat monitoring

Discovery Timeline

• 2026-09-21 - CVE-2026-83621 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-83621

Vulnerability Analysis

The flaw resides in scripts/lua/rest/v2/edit/system/edit_blacklist.lua. The handler processes list_name, list_enabled, url, and list_update parameters from a POST request and forwards them to lists_utils.editList. Because the script does not call isAdministrator() before executing the update, any authenticated session token — including one belonging to a read-only or unprivileged operator — can mutate blocklist configuration.

ntopng persists these changes in Redis. When the daemon reloads blocklist configuration, it re-reads the tampered entries without an additional authorization check at the persistence or loader layer. This defense-in-depth gap converts a single missing check into a persistent configuration compromise. An attacker can point a legitimate blocklist name at an attacker-controlled server that serves benign or empty entries, effectively disabling the feed while leaving it visibly "enabled" in the UI.

Root Cause

The REST handler assumes upstream authentication is sufficient authorization. ntopng's role model distinguishes administrators from standard users, but edit_blacklist.lua never enforced that distinction. The fix adds an explicit isAdministrator() gate at the top of the script that returns rest_utils.consts.err.not_granted for non-admin callers.

Attack Vector

Exploitation requires network access to the ntopng web interface and any valid non-admin credentials. The attacker sends a crafted POST to /lua/rest/v2/edit/system/edit_blacklist.lua supplying a target list_name, a malicious url, and desired list_enabled / list_update values. The change is written to Redis, reloaded, and future threat-intelligence fetches pull attacker-controlled data.

 local rest_utils = require "rest_utils"
 local lists_utils = require "lists_utils"
 
+-- #################################
+
+-- Checking root privileges
+if not isAdministrator() then
+  rest_utils.answer(rest_utils.consts.err.not_granted)
+  return
+end
+
+-- #################################
+
 local enabled = _POST["list_enabled"]
 local list_name = _POST["list_name"]
 local category = tonumber(_POST["category"])

Source: GitHub Commit 1d0627d802c5. The patch inserts a privilege check that short-circuits the handler for any non-administrator caller.

Detection Methods for CVE-2026-83621

Indicators of Compromise

• POST requests to /lua/rest/v2/edit/system/edit_blacklist.lua originating from non-admin user sessions in ntopng access logs.
• Blocklist entries in Redis whose url field points to unexpected external domains or non-HTTPS hosts.
• Sudden reductions in blocklist entry counts, or blocklists reporting successful updates while producing zero blocked flows.
• Scheduled blocklist update jobs silently skipped or marked disabled without corresponding administrator activity.

Detection Strategies

• Audit ntopng HTTP access logs for calls to edit_blacklist.lua and correlate the session user against the administrator role list.
• Snapshot the Redis-persisted blocklist configuration on a schedule and diff against a known-good baseline to surface unauthorized url or enabled changes.
• Alert on blocklist download endpoints resolving to non-approved external domains via DNS or egress proxy telemetry.

Monitoring Recommendations

• Forward ntopng application and web-server logs to a centralized analytics platform for retention and correlation with authentication events.
• Track blocklist reload events and compare downloaded feed sizes over time to detect content substitution.
• Monitor for privilege-role changes and anomalous REST API usage by standard (non-admin) accounts.

How to Mitigate CVE-2026-83621

Immediate Actions Required

• Upgrade ntopng to version 6.7.260717 or later, which introduces the isAdministrator() check in edit_blacklist.lua.
• Review current blocklist definitions in the ntopng UI and Redis, and restore any modified url, list_enabled, or list_update values to trusted defaults.
• Rotate credentials for all non-administrator ntopng accounts and audit their recent REST API activity.

Patch Information

The vendor fix is contained in commits 1d0627d802c5 and 669589fe208f, released in ntopng 6.7.260717. Details are published in GitHub Security Advisory GHSA-ffg5-889g-f5q8.

Workarounds

• Restrict network access to the ntopng web interface using a reverse proxy or firewall rules that permit only administrator source IPs.
• Remove or disable non-administrator accounts on affected ntopng instances until the upgrade is applied.
• Place a web application firewall rule in front of ntopng that blocks POST requests to /lua/rest/v2/edit/system/edit_blacklist.lua from non-admin sessions.

# Example nginx snippet restricting the vulnerable endpoint by source IP
location = /lua/rest/v2/edit/system/edit_blacklist.lua {
    allow 10.0.0.0/24;   # administrator management subnet
    deny  all;
    proxy_pass http://ntopng_backend;
}