CVE-2026-86090: ntopng Authentication Bypass Vulnerability

CVE-2026-86090 Overview

CVE-2026-86090 is a missing authorization vulnerability [CWE-862] in ntopng, the open-source network traffic monitoring platform. Versions before 6.7.260717 fail to enforce capability checks in the REST v2 handlers for deleting notification endpoints and recipients. Any authenticated non-administrator user can send POST requests to these endpoints and irreversibly delete every configured notification endpoint and recipient. The result is that all alerts generated by ntopng are silently suppressed, without triggering warnings to administrators.

Critical Impact

Authenticated low-privilege users can wipe all notification endpoints and recipients, silencing every alert channel and blinding defenders to ongoing network events.

Affected Products

• ntopng versions prior to 6.7.260717
• Deployments exposing the REST v2 API to authenticated non-administrator users
• ntopng instances relying on notification endpoints for alert delivery

Discovery Timeline

• 2026-09-04 - CVE CVE-2026-86090 published to NVD
• 2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-86090

Vulnerability Analysis

The flaw is a classic missing authorization issue in two REST v2 handlers: scripts/lua/rest/v2/delete/endpoints.lua and scripts/lua/rest/v2/delete/recipients.lua. Both handlers process POST requests but do not verify whether the authenticated user holds the notifications or pools capability. Any user with valid session credentials can invoke these endpoints and call endpoints.reset_configs() and recipients.cleanup(), which purge notification configuration state.

The destruction is irreversible from within the application. Once endpoints and recipients are deleted, ntopng continues to generate alerts internally but has no delivery channels. Administrators receive no email, webhook, syslog, or messaging notifications until they manually rebuild the configuration.

Root Cause

The root cause is the absence of a capability check at the entry point of the delete handlers. ntopng ships with an auth module that exposes auth.has_capability() for role-based enforcement, but the delete handlers did not call it. The pools_rest_utils.delete_all_instances_pools() helper likewise lacked a capability gate, allowing pool-wide deletion via the same code path.

Attack Vector

Exploitation requires network access to the ntopng web interface and valid credentials for any non-administrator account. The attacker issues authenticated POST requests to the vulnerable REST v2 delete endpoints. No user interaction, elevated privileges, or additional preconditions are required.

// Patch: scripts/lua/rest/v2/delete/endpoints.lua
 local rest_utils = require "rest_utils"
 local endpoints = require("endpoints")
 local recipients = require "recipients"
+local auth = require "auth"
+
+if not auth.has_capability(auth.capabilities.notifications) then
+   rest_utils.answer(rest_utils.consts.err.not_granted)
+   return
+end

 endpoints.reset_configs()
 recipients.cleanup()

Source: Commit 7d830f31

// Patch: scripts/lua/modules/pools/pools_rest_utils.lua
 function pools_rest_utils.delete_all_instances_pools()
+   if not auth.has_capability(auth.capabilities.pools) then
+      rest_utils.answer(rest_utils.consts.err.not_granted)
+      return
+   end
+
    local all_instances = pools_lua_utils.all_pool_instances_factory()

    for _, instance in pairs(all_instances) do

Source: Commit 7d830f31

Detection Methods for CVE-2026-86090

Indicators of Compromise

• POST requests from non-administrator sessions to /lua/rest/v2/delete/endpoints.lua or /lua/rest/v2/delete/recipients.lua
• Sudden disappearance of configured notification endpoints and recipients in the ntopng admin UI
• Cessation of expected alert traffic to email, webhook, syslog, or messaging integrations without a corresponding configuration change ticket

Detection Strategies

• Review ntopng HTTP access logs for POST requests targeting the REST v2 delete handlers and correlate the source user with role assignments
• Baseline the expected count of notification endpoints and recipients, then alert on drops to zero or sharp declines
• Monitor for gaps in outbound alert delivery from ntopng using downstream receivers such as SIEM ingestion counts

Monitoring Recommendations

• Forward ntopng web server and audit logs to a centralized log platform for retention and correlation
• Alert on any invocation of endpoints.reset_configs or recipients.cleanup code paths in application logs
• Track ntopng version strings across the fleet to identify hosts still running versions before 6.7.260717

How to Mitigate CVE-2026-86090

Immediate Actions Required

• Upgrade ntopng to version 6.7.260717 or later on all instances
• Audit existing user accounts and remove non-administrator accounts that do not require access to the web interface
• Restrict network access to the ntopng management interface to trusted administrator networks
• Back up the current notification endpoint and recipient configuration so it can be restored if deletion occurs

Patch Information

The fix is delivered in commit 7d830f31 and included in ntopng 6.7.260717. The patch adds auth.has_capability() checks to the delete endpoints and recipients handlers, and to pools_rest_utils.delete_all_instances_pools(). See the GitHub Security Advisory GHSA-m22w-f647-vx88 and the VulnCheck advisory for full details.

Workarounds

• Place ntopng behind a reverse proxy that blocks unauthenticated and low-privilege sessions from reaching /lua/rest/v2/delete/endpoints.lua and /lua/rest/v2/delete/recipients.lua
• Limit user account creation to trusted administrators until patching is complete
• Export and store notification endpoint and recipient configurations off-host to enable rapid recovery

# Example nginx rule to block the vulnerable delete endpoints at the proxy
location ~ ^/lua/rest/v2/delete/(endpoints|recipients)\.lua$ {
    allow 10.0.0.0/24;   # admin subnet
    deny all;
    proxy_pass http://ntopng_backend;
}