CVE-2026-84990: ntopng Information Disclosure Vulnerability

CVE-2026-84990 Overview

CVE-2026-84990 affects ntopng, a web-based network traffic monitoring application. The vulnerability allows any authenticated non-admin user to list and download system-configuration backups without an administrator authorization check. Downloaded backups include the ntopng.user.* Redis key space, exposing password hashes, API tokens, TOTP secrets, and WebAuthn credential data for local users. Attackers with low-privileged credentials can escalate to full administrative control by cracking or reusing the disclosed authentication material. The issue is fixed in version 6.7.260718.

Critical Impact
Low-privileged authenticated users can extract password hashes and multi-factor credentials for all local ntopng accounts, enabling account takeover and privilege escalation to administrator.

Affected Products

ntopng versions prior to 6.7.260718
scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua REST endpoint
scripts/lua/rest/v2/get/system/configurations/download_backup.lua REST endpoint

Discovery Timeline

2026-09-21 - CVE-2026-84990 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-84990

Vulnerability Analysis

The vulnerability is a broken access control flaw [CWE-200] in two ntopng REST endpoints. Both the backup listing and backup download routes accept any authenticated session without verifying administrative privileges. The download handler invokes backup_config.export_backup, which in turn calls prefs_dump_utils.build_prefs_dump_table to serialize configuration state.

The serialized backup includes the entire ntopng.user.* Redis key space. This namespace stores local user password hashes, API tokens, TOTP shared secrets, and WebAuthn credential material. Any authenticated non-admin account can retrieve this data over the network and process it offline. The result is credential compromise across every local account defined on the ntopng instance.

Root Cause

The two Lua REST handlers did not call isAdministratorOrPrintErr() before executing sensitive backup operations. Authorization was implicit in the UI but never enforced at the API layer. This design assumption allowed direct requests to bypass administrator gating entirely.

Attack Vector

An attacker requires only a valid low-privileged ntopng account to exploit CVE-2026-84990. The attacker calls the list endpoint to enumerate available backup epochs, then calls the download endpoint to retrieve backup archives. Extracted password hashes and secrets enable offline cracking or direct reuse against the same or federated systems.

text

-- Patch applied to download_backup.lua and list_available_backups.lua
-- ##############################################

+if not isAdministratorOrPrintErr() then
+    rest_utils.answer(rest_utils.consts.err.not_granted)
+    return
+end
+
 local download = _GET["download"]
 local epoch = _GET["epoch"]

Source: GitHub Commit f912ee93

Detection Methods for CVE-2026-84990

Indicators of Compromise

HTTP GET requests from non-admin user sessions to /lua/rest/v2/get/system/configurations/list_available_backups.lua.
HTTP GET requests from non-admin user sessions to /lua/rest/v2/get/system/configurations/download_backup.lua with download or epoch parameters.
Unexpected backup export activity outside of scheduled administrative maintenance windows.

Detection Strategies

Correlate ntopng web access logs against the authenticated user's role and alert when non-admin accounts reach the backup REST paths.
Inspect response sizes on the download endpoint for large payloads served to non-admin sessions.
Baseline normal backup access patterns and flag deviations in source IP, user agent, or request frequency.

Monitoring Recommendations

Forward ntopng application and reverse-proxy logs to a centralized log platform for role-aware analytics.
Monitor for post-exploitation credential reuse, including anomalous logins to ntopng or federated systems using known local account names.
Track Redis access patterns on the ntopng.user.* key space if Redis auditing is enabled.

How to Mitigate CVE-2026-84990

Immediate Actions Required

Upgrade ntopng to version 6.7.260718 or later on all deployments.
Rotate all local ntopng user passwords, API tokens, and TOTP secrets after upgrading.
Re-enroll WebAuthn credentials for any accounts that had authenticators registered.
Audit authentication logs for suspicious administrative logins predating the upgrade.

Patch Information

The fix adds an isAdministratorOrPrintErr() check at the top of both list_available_backups.lua and download_backup.lua. Unauthorized callers now receive rest_utils.consts.err.not_granted. See the GitHub Security Advisory GHSA-7gqc-vjwr-6rh5 and the GitHub Commit f912ee93 for the applied changes.

Workarounds

Restrict network access to the ntopng web interface to trusted administrator subnets until patching is complete.
Block the two vulnerable REST paths at an upstream reverse proxy for any session that is not verified as administrator.
Disable or remove non-admin local accounts that are not strictly required during the remediation window.

bash

# Example nginx snippet to gate backup endpoints at the reverse proxy
location ~ ^/lua/rest/v2/get/system/configurations/(list_available_backups|download_backup)\.lua$ {
    allow 10.0.0.0/24;   # admin management subnet
    deny all;
    proxy_pass http://ntopng_backend;
}