Argument Injection in LibreNMS graph_title Parameter

LibreNMS versions prior to 26.8.0 are susceptible to an argument injection vulnerability identified as CVE-2026-86427. The vulnerability exists within the processing of the 'graph_title' parameter, where insufficient neutralization of special characters allows an authenticated attacker to break out of the intended double-quote escaping. By manipulating this parameter, an attacker can influence the execution of the 'rrdtool' utility. This allows for the injection of malicious 'DEF' and 'LINE' arguments, facilitating the unauthorized retrieval of RRD database files belonging to other monitored devices. Furthermore, the use of newline injection enables the execution of arbitrary 'rrdtool' commands, allowing attackers to bypass configured per-device authorization checks. This flaw poses a significant risk to the integrity and confidentiality of network monitoring data managed by LibreNMS.

Impact

Successful exploitation allows authenticated users to access sensitive network performance data from unauthorized devices or execute arbitrary commands within the context of the rrdtool process. This can lead to unauthorized information disclosure and potential escalation of control over the monitoring platform.

Recommendation

• Upgrade LibreNMS instances to version 26.8.0 or later immediately to patch the argument injection vulnerability in the graph_title parameter.
• Review web server access logs for requests containing newline characters or suspicious rrdtool flags (e.g., DEF, LINE) within the graph_title parameter string.
• Restrict access to the LibreNMS monitoring interface to trusted users only to mitigate the risk from authenticated attackers.