LibreNMS CVE-2026-86427

Exploitation requires a valid LibreNMS account with at least low-level (read/graph) privileges - PR:L per the CVSS 4.0 vector. The attacker must be able to reach the LibreNMS web interface over the network (AV:N). No special non-default configuration is required; any standard LibreNMS deployment using the affected graphing functionality is vulnerable. The authorization bypass specifically targets per-device access controls: a user restricted to a subset of devices can exploit this to read RRD data from any device in the system. The vulnerability does not exist in a disabled-by-default feature; graphing is core LibreNMS functionality. No user interaction is needed (UI:N). Exploitation is limited to authenticated sessions - unauthenticated remote access is not possible.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7, reflecting network-reachable, low-complexity exploitation requiring only a low-privilege account. The C:H/I:H/A:H impact triad is broadly consistent with the ability to read arbitrary RRD files (confidentiality), execute unauthorized rrdtool write/alter commands (integrity), and potentially corrupt RRD databases or exhaust resources (availability). The PR:L requirement is the primary limiting factor: the attack is not pre-authentication and requires a valid LibreNMS account. There is no CISA KEV listing and no publicly known proof-of-concept at time of analysis; EPSS data was not provided. The VulnCheck report increases confidence that the issue was properly analyzed before disclosure. The real-world priority is moderate-to-high for organizations where LibreNMS accounts are broadly issued or where insider threats or phishing of low-privilege accounts are plausible. The per-device authorization bypass has a chilling effect on multi-tenant or segmented LibreNMS deployments where users are intentionally scoped to specific device subsets.

An attacker with a low-privilege LibreNMS account - obtained via phishing, credential stuffing, or insider access - submits a crafted HTTP request to a graphing endpoint with a graph_title value that breaks out of double-quote escaping and appends rrdtool DEF arguments pointing to RRD files of devices outside their authorization scope. Using newline injection, they can chain additional rrdtool subcommands to extract performance data for any device on the monitored network. No proof-of-concept is publicly known at time of analysis, but the technique is straightforward for anyone familiar with rrdtool's command-line interface.