High priorityDisclosed

Advisory · CVE-2026-109357

LibreNMS LDAP filter injection allows authentication bypass

LibreNMS in LDAP or Active Directory authorization mode inserts usernames unescaped into LDAP search filters, so an unauthenticated attacker sending a wildcard username over HTTP Basic authentication can match all users and groups and gain admin access. Fixed in 26.9.0.

Advisory published October 12, 2026Independent summary
Vendor
LibreNMS
Product
LibreNMS
Identifier / CWE
CVE-2026-109357
CWE-90
Action timing
Immediate
ELI5

Explain it like I’m five

The bouncer checks a guest list by pasting the name you shout into the list query. Shout the wildcard character and the query matches everyone, so you are waved in as the manager.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Basic auth sent

    An unauthenticated attacker sends an HTTP Basic authentication request to a LibreNMS instance using LDAP or Active Directory authorization.

  2. 02Wildcard username

    The username is a wildcard chosen to match every LDAP user and group.

  3. 03Filter injected

    The username is inserted unescaped into the LDAP search filter, and authentication only checks that a user exists.

  4. 04Admin access gained

    The wildcard match satisfies the checks and the attacker gains admin access.

What happened

The LibreNMS security advisory for CVE-2026-109357 covers LibreNMS before 26.9.0 and rates the flaw CVSS 3.1 8.1, CVSS 4.0 9.2.

In the LDAP and Active Directory authorization modes, usernames are inserted unescaped into LDAP search filters, and authentication only checks that the user exists. Where the remote user is not forwarded from a proxy, an unauthenticated attacker can send a wildcard username through HTTP Basic authentication, match all users and groups, and gain admin access to the LibreNMS instance.

Per the advisory record, 26.9.0 is the fixed release.

LibreNMS admin access exposes network topology, device credentials stored for polling, and alerting configuration, so a monitoring login is a high-value target.

What to do

  1. Inventory LibreNMS instances, noting which use LDAP or Active Directory authorization.
  2. Upgrade affected instances to LibreNMS 26.9.0 or later.
  3. Restrict network access to the LibreNMS web interface until upgraded.
  4. Review authentication logs for Basic auth attempts with wildcard or filter characters in the username.
  5. Audit admin accounts, users, and device credential changes for anything you do not recognize.
  6. Confirm the deployed version after upgrading.

Management note

Monitoring systems are often exempted from the scrutiny given to business apps, yet they hold maps and credentials for the whole network. An unauthenticated path to LibreNMS admin should be prioritized like one.