Executive brief
LibreNMS is an open-source network monitoring platform whose REST API is the primary interface for automation and integrations. An unauthenticated attacker can bypass API authentication and gain full access to any existing API token's privileges by exploiting MySQL type coercion, potentially accessing device credentials, sensitive network data, and triggering remote code execution through alert templates on affected systems.
Technical details
LibreNMS REST API authentication validates tokens by comparing a user-supplied token against token hashes stored in a MySQL text column. The vulnerability stems from improper type handling: when the API receives a JSON-encoded numeric value (e.g., {"api_token": 0}), it reaches the database as an integer rather than a string. MySQL's type coercion converts text token hashes to numbers by their leading digits (e.g., "9cd9a5e2..." → 9, "abcdef01..." → 0), allowing single-digit guesses to match approximately 44% of tokens in one request. No rate limiting on the API group enables rapid enumeration; an attacker can sweep values 0–9 and beyond in seconds to find a valid token. Successful exploitation grants full access to the matched token's privileges, including administrative API functions that support Laravel Blade template rendering with @php blocks—a documented feature enabling arbitrary code execution on the server.
Affected products
- LibreNMS LibreNMS < 26.8.0
Timeline
- 2026-08-23: advisory: GitHub Security Advisory GHSA-cvq8-gqfq-3mvg published
- 2026-09-07: disclosed: CVE-2026-86426 disclosed on NVD
- 2026-08-23: patched: Fixed in version 26.8.0