Is CVE-2026-86426 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86426 being exploited in the wild.

How severe is CVE-2026-86426?

Critical severity, with a CVSS score of 9.8, published 7 September 2026.

Is there a fix for CVE-2026-86426?

A patch was published on 2026-08-23: Fixed in version 26.8.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86426 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86426?

Check whether you run Librenms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86426: LibreNMS REST API authentication bypass via type coercion

CVE-2026-86426 · Severity: critical · CVSS 9.8 · Published 2026-09-07

LibreNMS is an open-source network monitoring platform whose REST API is the primary interface for automation and integrations. An unauthenticated attacker can bypass API authentication and gain full access to any existing API token's privileges by exploiting MySQL type coercion, potentially accessing device credentials, sensitive network data, and triggering remote code execution through alert templates on affected systems.

Technologies: Librenms. Vendors: Librenms.

Quick answers

Is CVE-2026-86426 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86426 being exploited in the wild.
How severe is CVE-2026-86426?: Critical severity, with a CVSS score of 9.8, published 7 September 2026.
Which products and versions are affected?: Librenms < 26.8.0.
Is there a fix for CVE-2026-86426?: A patch was published on 2026-08-23: Fixed in version 26.8.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86426 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86426?: Check whether you run Librenms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

LibreNMS REST API authentication validates tokens by comparing a user-supplied token against token hashes stored in a MySQL text column. The vulnerability stems from improper type handling: when the API receives a JSON-encoded numeric value (e.g., {"api_token": 0}), it reaches the database as an integer rather than a string. MySQL's type coercion converts text token hashes to numbers by their leading digits (e.g., "9cd9a5e2..." → 9, "abcdef01..." → 0), allowing single-digit guesses to match approximately 44% of tokens in one request. No rate limiting on the API group enables rapid enumeration; an attacker can sweep values 0–9 and beyond in seconds to find a valid token. Successful exploitation grants full access to the matched token's privileges, including administrative API functions that support Laravel Blade template rendering with @php blocks—a documented feature enabling arbitrary code execution on the server.

Affected products

LibreNMS LibreNMS < 26.8.0

Timeline

2026-08-23: advisory: GitHub Security Advisory GHSA-cvq8-gqfq-3mvg published
2026-09-07: disclosed: CVE-2026-86426 disclosed on NVD
2026-08-23: patched: Fixed in version 26.8.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.