Time-Based Blind SQL Injection in LibreNMS Network Monitoring Tool

CVE-2026-26990

What is CVE-2026-26990?

LibreNMS, an auto-discovering network monitoring tool based on PHP/MySQL/SNMP, is exposed to a Time-Based Blind SQL Injection through the address parameter in the address-search.inc.php file. This vulnerability allows authenticated users to input a crafted subnet prefix that, when processed, directly modifies an SQL query without using parameter binding. As a result, attackers can manipulate the query logic, leading to potential exposure of sensitive database information by observing time-based responses. The vulnerability has been addressed in version 26.2.0.

References