EUVD-2026-72384
GHSA-84cr-xjpw-q9mc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network, unauthenticated, no UI; AC:H because success depends on an attacker-uncontrolled condition (a token hash coercing to a small integer); full C/I/A via credential theft and alert-template RCE.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to match token hashes, gaining access to API functionality including device credentials and administrative features that enable remote code execution through alert templates.
AnalysisAI
Authentication bypass in the LibreNMS REST API (all versions before 26.8.0) lets unauthenticated remote attackers reach protected endpoints by submitting a small integer (0-9) in place of a string API token, abusing MySQL loose type coercion so the integer matches a stored token hash. Successful bypass exposes device credentials and administrative functionality, and can be chained to remote code execution through alert templates. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network reachability to the LibreNMS REST API of an instance running a version before 26.8.0, with at least one valid API token present whose stored hash begins with a digit so it coerces to one of the integers 0-9 the attacker submits. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals align on high priority: CVSS 4.0 base 9.2 with AV:N/AC:L/PR:N/UI:N and full VC:H/VI:H/VA:H, meaning network-reachable, unauthenticated, high-impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to LibreNMS 26.8.0 or later, which enforces strict string comparison of API tokens (per GHSA-cvq8-gqfq-3mvg). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all LibreNMS instances in your environment, confirm which versions are running, and immediately restrict REST API access via firewall rules if the instances are exposed to untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in LibreNMS through 1.47. Rated high severity (CVSS 7.2), this vulnerability is remotely exploit
Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php. Rate
An issue was discovered in LibreNMS through 1.47. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
SQL injection in LibreNMS 25.12.0 and below. PoC and patch available.
An issue was discovered in LibreNMS through 1.47. Rated critical severity (CVSS 9.1), this vulnerability is remotely exp
SQL injection in LibreNMS versions 25.12.0 and below allows authenticated users to extract sensitive database informatio
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated high severity (CVSS 8.8), this vulnera
An issue was discovered in LibreNMS before 1.65.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
An issue was discovered in LibreNMS 1.50.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
An issue was discovered in LibreNMS through 1.47. Rated high severity (CVSS 8.8), this vulnerability is remotely exploit
Command injection in LibreNMS's Virtualization Discovery module enables authenticated administrator-level users to execu
Remote code execution in LibreNMS network monitoring platform (versions prior to 26.3.0) allows authenticated administra
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today