Is CVE-2026-108715 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108715 being exploited in the wild.

How severe is CVE-2026-108715?

Medium severity, with a CVSS score of 4.3, published 11 October 2026.

Is there a fix for CVE-2026-108715?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-108715 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-108715?

Check whether you run Librenms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108715: LibreNMS authorization bypass in smokeping graph auth

CVE-2026-108715 · Severity: medium · CVSS 4.3 · Published 2026-10-11

LibreNMS is a network monitoring system that tracks device performance and availability across infrastructure. A flaw in its graph authorization logic allows users with restricted access to a monitoring probe to view network latency data and enumerate device names that they should not have permission to access, potentially revealing sensitive network topology information.

Technologies: Librenms. Vendors: Librenms.

Quick answers

Is CVE-2026-108715 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108715 being exploited in the wild.
How severe is CVE-2026-108715?: Medium severity, with a CVSS score of 4.3, published 11 October 2026.
Which products and versions are affected?: Librenms through 26.9.1.1.
Is there a fix for CVE-2026-108715?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108715 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-108715?: Check whether you run Librenms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass exists in the smokeping graph authentication handler that validates the requesting user's permissions against the source probe device rather than the target device being graphed. Attackers with restricted probe device permissions can craft requests to smokeping_in or smokeping_out graph endpoints with arbitrary device IDs, bypassing access controls to enumerate device names and view latency metrics.

Affected products

LibreNMS LibreNMS through 26.9.1.1

Timeline

2026-10-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.