LibreNMS (< 26.9.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/librenms--26.9.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 12 Oct 2026 18:37:49 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLDAP Filter Injection in LibreNMS Authentication Moduleshttps://feed.craftedsignal.io/briefs/2026-10-librenms-ldap-injection/Mon, 12 Oct 2026 18:37:49 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-librenms-ldap-injection/LibreNMS versions prior to 26.9.0 are vulnerable to LDAP filter injection, allowing unauthenticated attackers to bypass authentication and gain administrative access via crafted HTTP Basic Authorization headers.LibreNMS versions before 26.9.0 contain a critical vulnerability in the ldap-authorization and ad-authorization modules. The application fails to properly sanitize and escape usernames before incorporating them into LDAP search filters during the authentication process. Because the authentication logic only verifies the existence of a user rather than validating their credentials, the application is susceptible to LDAP filter injection. An unauthenticated attacker can exploit this by submitting a crafted username, such as a wildcard character, within the PHP_AUTH_USER field of an HTTP Basic Authorization header. This manipulation causes the LDAP backend to return a successful match for all users and groups, effectively bypassing authentication controls and granting the attacker administrative privileges within the LibreNMS instance.

Attack Chain

  1. Attacker identifies an internet-facing LibreNMS instance using ldap-authorization or ad-authorization.
  2. Attacker crafts an HTTP request containing the HTTP Basic Authorization header.
  3. Attacker populates the PHP_AUTH_USER parameter with an LDAP injection payload (e.g., a wildcard character '*').
  4. The LibreNMS server receives the request and parses the unescaped username for the LDAP search filter.
  5. The application executes the malformed LDAP query against the configured directory server.
  6. The directory server returns a positive match for the injected query, signaling user existence to the LibreNMS application.
  7. LibreNMS grants the attacker an active session based on the successful, albeit bypassed, authentication check.
  8. Attacker gains full administrative access to the network monitoring dashboard, enabling exfiltration of network topology data or further system exploitation.

Impact

Successful exploitation allows an unauthenticated, remote attacker to bypass authentication mechanisms and gain administrative control over the LibreNMS monitoring platform. This access provides visibility into sensitive network infrastructure, including device configurations, performance metrics, and network maps. Depending on the environment, an attacker could leverage this platform access to pivot into the internal network, modify monitoring alerts to conceal malicious activity, or gain further credentials stored within the monitoring system.

Recommendation

  • Upgrade LibreNMS to version 26.9.0 or later immediately to patch the improper input validation in authentication modules.
  • Monitor web server logs for HTTP requests with unusual characters or wildcard patterns in the PHP_AUTH_USER field to detect exploitation attempts.
  • If upgrading is not immediately possible, restrict access to the LibreNMS web interface to trusted internal networks or implement additional pre-authentication controls (e.g., VPN or mTLS) to mitigate unauthenticated access.
  • Audit web server access logs for anomalous, high-frequency authentication attempts originating from a single source or utilizing non-standard usernames.
]]>highadvisoryldap-injectionauthentication-bypassweb-vulnerability