LDAP Filter Injection Vulnerability in LibreNMS Affects User Authentication
CVE-2026-109357

9.2CRITICAL

Key Information:

Vendor

Librenms

Status
Librenms
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109357?

An LDAP filter injection vulnerability exists in LibreNMS versions prior to 26.9.0, allowing unauthenticated attackers to exploit unescaped usernames within LDAP search filters. This flaw in user authentication processes enables attackers to send a wildcard username through HTTP Basic Authorization. If the REMOTE_USER is not properly forwarded, attackers can potentially match all users and groups, leading to unauthorized admin access.

Affected Version(s)

librenms 0 < 26.9.0

librenms 26.9.0

References

https://github.com/librenms/librenms/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/librenms-before-26.9...
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

offset
.