CVE-2026-26990 json
LibreNMS has Time-Based Blind SQL Injection in address-search.inc.php
published 2026-02-18 8 mo ago modified 2026-06-17 4 mo ago also GHSA-79q9-wc6p-cf92 , EUVD-2026-8037
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.5%
- EPSS 4.5% chance of exploitation in 30 days, percentile 91%
- public exploits
- 0
- none known
Summary
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses. This vulnerability requires authentication and is exploitable by any authenticated user. This issue has been fixedd in version 26.2.0.
Patch / fix
- packagist librenms/librenms 26.2.0
- librenms librenms 26.2.0
- github.com/librenms/librenms@1542958 commit
- github.com/librenms/librenms#18777 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 8 mo ago
Exploit prediction
4.47% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/librenms/librenms/security/advisories/GHSA-79q9-wc6p-cf92 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | librenms/librenms | <26.2.0 |
26.2.0 |
Affected products
- librenms librenms
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/librenms/librenms/pull/18777
web, issue-tracking
-
github.com
/librenms/librenms/commit/15429580baba03ed1dd377bada1bde4b7a1175a1
web, patch
-
github.com
/librenms/librenms/security/advisories/GHSA-79q9-wc6p-cf92
web, exploit, third-party-advisory
-
github.com
/librenms/librenms
package
Sources
- CVE List CVE-2026-26990
- GitHub Advisory GHSA-79q9-wc6p-cf92
- NVD CVE-2026-26990
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.