Quick answers
- Is CVE-2026-86427 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86427 being exploited in the wild.
- How severe is CVE-2026-86427?
- High severity, with a CVSS score of 8.8, published 7 September 2026.
- Which products and versions are affected?
- Librenms before 26.8.0.
- Is there a fix for CVE-2026-86427?
- A patch was published on 2026: version 26.8.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-86427 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-86427?
- Check whether you run Librenms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a command injection flaw in the graph_title query parameter passed to rrdtool. The application only strips single quotes but fails to sanitize double quotes, which are the actual quoting mechanism used when serializing rrdtool command options. An authenticated attacker can inject a double quote to break out of the title argument's quoting boundary and inject arbitrary rrdtool graph arguments (DEF, CDEF, LINE). Additionally, URL-encoded newlines (%0a) allow execution of entirely separate rrdtool commands via stdin. The per-device authorization check validates access based on the URL path but does not inspect injected rrdtool options for unauthorized file references, allowing attackers to read RRD files from any device by specifying absolute paths. The vulnerability is patched in version 26.8.0.
Affected products
- LibreNMS LibreNMS before 26.8.0
Timeline
- 2026-08-23: disclosed
- 2026-09-07: advisory
- 2026: patched: version 26.8.0