CVE-2026-86091: ntopng Privilege Escalation Vulnerability

CVE-2026-86091 Overview

CVE-2026-86091 is a missing authorization vulnerability [CWE-862] in ntopng versions before 6.7.260717. The flaw resides in the host pools bulk-delete REST endpoint, which fails to verify user privileges before executing destructive operations. Any authenticated non-administrator can issue a POST request to the delete pools handler and irreversibly remove every host pool and its member bindings. Because host pools govern traffic policies and visibility restrictions in ntopng, their deletion can silently bypass security policies enforced through pool membership. The vulnerability was patched in commit 7d830f31af367745431c5d92e2e82fc432f6bdd8.

Critical Impact
Any authenticated low-privileged user can wipe all ntopng host pools, destroying traffic policy bindings and effectively removing visibility and enforcement controls across monitored hosts.

Affected Products

ntopng versions prior to 6.7.260717
ntopng REST v2 delete pools endpoint (scripts/lua/rest/v2/delete/pools.lua)
ntopng notification endpoints delete handler (scripts/lua/rest/v2/delete/endpoints.lua)

Discovery Timeline

2026-09-04 - CVE-2026-86091 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86091

Vulnerability Analysis

ntopng exposes a REST v2 API that includes a bulk-delete endpoint for host pools. Host pools are logical groupings of hosts used to apply traffic policies, quotas, and visibility restrictions. The endpoint pools_rest_utils.delete_all_instances_pools() iterates through every registered pool instance and deletes all pools without first confirming the caller holds the pools capability. Authenticated users of any role can therefore invoke the handler and destroy pool configuration data. The same commit also corrects an equivalent missing check in the notification endpoints delete handler, which previously permitted low-privileged users to reset notification recipient configuration.

Root Cause

The root cause is a missing authorization check [CWE-862]. The Lua handler in scripts/lua/modules/pools/pools_rest_utils.lua did not call auth.has_capability(auth.capabilities.pools) before executing the destructive loop. Authentication alone was treated as sufficient, so any session token issued to a non-administrator satisfied the endpoint's access requirements.

Attack Vector

An attacker who holds valid credentials for any ntopng account can send a network-reachable POST request to the delete pools REST route. No user interaction, elevated privileges, or additional exploitation primitives are required. The result is permanent removal of all host pool records and their associated member bindings, which invalidates traffic policies that depend on pool membership.

text

-- Patched handler in scripts/lua/modules/pools/pools_rest_utils.lua
-- @brief Get all pools of all the available (currently implemented) pool instances
function pools_rest_utils.delete_all_instances_pools()
+   if not auth.has_capability(auth.capabilities.pools) then
+      rest_utils.answer(rest_utils.consts.err.not_granted)
+      return
+   end
+
   local all_instances = pools_lua_utils.all_pool_instances_factory()

   for _, instance in pairs(all_instances) do

Source: ntopng Commit 7d830f31

The companion patch adds the same guard to the notification endpoints delete route:

text

local rest_utils = require "rest_utils"
local endpoints = require("endpoints")
local recipients = require "recipients"
+local auth = require "auth"
+
+if not auth.has_capability(auth.capabilities.notifications) then
+   rest_utils.answer(rest_utils.consts.err.not_granted)
+   return
+end

endpoints.reset_configs()
recipients.cleanup()

Source: ntopng Commit 7d830f31

Detection Methods for CVE-2026-86091

Indicators of Compromise

POST requests to /lua/rest/v2/delete/pools.lua originating from non-administrator ntopng accounts.
Sudden disappearance of all host pool entries in the ntopng UI or configuration exports.
Loss of traffic policy enforcement for hosts that were previously bound to a pool.
Corresponding POST requests to /lua/rest/v2/delete/endpoints.lua that reset notification recipients.

Detection Strategies

Enable ntopng access logging and alert on any DELETE-class REST calls executed by users whose role does not include the pools capability.
Baseline the expected count of host pools and generate an alert when the count drops sharply between polling intervals.
Correlate ntopng audit events with authentication logs to attribute pool deletions to a specific user session.

Monitoring Recommendations

Forward ntopng HTTP access and application logs to a centralized log platform for retention and query.
Monitor for repeated not_granted responses after patching, which may indicate probing by an authenticated attacker.
Track configuration drift on host pool definitions and notification recipients to detect unauthorized resets.

How to Mitigate CVE-2026-86091

Immediate Actions Required

Upgrade ntopng to version 6.7.260717 or later, which contains commit 7d830f31af367745431c5d92e2e82fc432f6bdd8.
Audit all ntopng user accounts and remove or downgrade unused non-administrator accounts.
Rotate credentials for any ntopng accounts that may have been shared or exposed.
Restore host pool definitions from backup if deletions are observed in logs.

Patch Information

The fix is available in the ntopng repository via commit 7d830f31af367745431c5d92e2e82fc432f6bdd8, which adds auth.has_capability checks to both the host pool bulk-delete handler and the notification endpoints delete handler. See the GitHub Security Advisory GHSA-m22w-f647-vx88 and the VulnCheck Advisory for full technical detail.

Workarounds

Restrict network access to the ntopng web interface to trusted administrators using a reverse proxy or firewall ACL.
Place ntopng behind an authenticating proxy that enforces additional role-based checks on /lua/rest/v2/delete/* routes until the upgrade is applied.
Reduce the number of authenticated ntopng users to the minimum required for operations.

bash

# Example nginx reverse proxy rule to block REST delete routes for non-admin networks
location ~ ^/lua/rest/v2/delete/(pools|endpoints)\.lua$ {
    allow 10.0.0.0/24;   # admin subnet
    deny  all;
    proxy_pass http://ntopng_backend;
}