CVE-2026-26990: LibreNMS Time-Based Blind SQL Injection Vulnerability
Summary
CVE-2026-26990: LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php. Affects librenms/librenms versions < 26.2.0. Fixed in 26.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring tool that provides a comprehensive suite of features for monitoring network devices, including performance metrics, alerts, and reporting. It is widely used by network administrators to ensure the health and performance of their networks. However, it is susceptible to a time-based blind SQL injection vulnerability that can be exploited by authenticated users.
Vulnerability Detail
A time-based blind SQL injection vulnerability exists in the address-search.inc.php file of LibreNMS, specifically through the address parameter. This vulnerability arises from the improper concatenation of user input into SQL queries without adequate parameter binding or sanitization. An attacker can exploit this vulnerability to manipulate SQL query logic and infer sensitive database information through time-based responses. The vulnerability requires authentication, allowing any authenticated user to exploit it and potentially extract sensitive information from the database, including privileged account details.
How To Fix
Minimum fixed version
26.2.0
This is the first release that contains the fix.
composer require librenms/librenms:26.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the affected endpoint (ajax_table.php) to only trusted users or implement additional input validation to sanitize the address parameter before it is processed in the SQL query.
Conclusion
The CVE-2026-26990 vulnerability in LibreNMS represents a significant security risk due to its potential for exploitation by authenticated users. It is crucial for users to update to the patched version to mitigate the risk of unauthorized data access and ensure the integrity of their network monitoring systems.
See every vulnerability recorded for librenms/librenms →
FAQ
A time-based blind SQL injection is a type of attack where the attacker can infer information from the database by observing the time it takes for the server to respond to certain queries.
Any authenticated user of LibreNMS can exploit this vulnerability, making it critical to secure user access.
An attacker can extract sensitive information such as database schema details, user credentials, and other confidential data stored in the database.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
