{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/librenms--26.9.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-109357"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["LibreNMS (\u003c 26.9.0)"],"_cs_severities":["high"],"_cs_tags":["ldap-injection","authentication-bypass","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["LibreNMS"],"content_html":"\u003cp\u003eLibreNMS versions before 26.9.0 contain a critical vulnerability in the ldap-authorization and ad-authorization modules. The application fails to properly sanitize and escape usernames before incorporating them into LDAP search filters during the authentication process. Because the authentication logic only verifies the existence of a user rather than validating their credentials, the application is susceptible to LDAP filter injection. An unauthenticated attacker can exploit this by submitting a crafted username, such as a wildcard character, within the PHP_AUTH_USER field of an HTTP Basic Authorization header. This manipulation causes the LDAP backend to return a successful match for all users and groups, effectively bypassing authentication controls and granting the attacker administrative privileges within the LibreNMS instance.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an internet-facing LibreNMS instance using ldap-authorization or ad-authorization.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP request containing the HTTP Basic Authorization header.\u003c/li\u003e\n\u003cli\u003eAttacker populates the PHP_AUTH_USER parameter with an LDAP injection payload (e.g., a wildcard character '*').\u003c/li\u003e\n\u003cli\u003eThe LibreNMS server receives the request and parses the unescaped username for the LDAP search filter.\u003c/li\u003e\n\u003cli\u003eThe application executes the malformed LDAP query against the configured directory server.\u003c/li\u003e\n\u003cli\u003eThe directory server returns a positive match for the injected query, signaling user existence to the LibreNMS application.\u003c/li\u003e\n\u003cli\u003eLibreNMS grants the attacker an active session based on the successful, albeit bypassed, authentication check.\u003c/li\u003e\n\u003cli\u003eAttacker gains full administrative access to the network monitoring dashboard, enabling exfiltration of network topology data or further system exploitation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated, remote attacker to bypass authentication mechanisms and gain administrative control over the LibreNMS monitoring platform. This access provides visibility into sensitive network infrastructure, including device configurations, performance metrics, and network maps. Depending on the environment, an attacker could leverage this platform access to pivot into the internal network, modify monitoring alerts to conceal malicious activity, or gain further credentials stored within the monitoring system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade LibreNMS to version 26.9.0 or later immediately to patch the improper input validation in authentication modules.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for HTTP requests with unusual characters or wildcard patterns in the PHP_AUTH_USER field to detect exploitation attempts.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, restrict access to the LibreNMS web interface to trusted internal networks or implement additional pre-authentication controls (e.g., VPN or mTLS) to mitigate unauthenticated access.\u003c/li\u003e\n\u003cli\u003eAudit web server access logs for anomalous, high-frequency authentication attempts originating from a single source or utilizing non-standard usernames.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T20:30:11Z","date_published":"2026-10-12T18:37:49Z","id":"https://feed.craftedsignal.io/briefs/2026-10-librenms-ldap-injection/","summary":"LibreNMS versions prior to 26.9.0 are vulnerable to LDAP filter injection, allowing unauthenticated attackers to bypass authentication and gain administrative access via crafted HTTP Basic Authorization headers.","title":"LDAP Filter Injection in LibreNMS Authentication Modules","url":"https://feed.craftedsignal.io/briefs/2026-10-librenms-ldap-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - LibreNMS (\u003c 26.9.0)","version":"https://jsonfeed.org/version/1.1"}