CVE-2026-86426

LibreNMS before 26.8.0 contains an authentication bypass (CWE-287) in its REST API that lets unauthenticated attackers reach protected endpoints. The flaw stems from MySQL type coercion: when an attacker sends small integers such as 0 through 9 in place of a string API token, the database matches the numeric value against stored token hashes, bypassing token validation. Successful exploitation grants access to API functionality, including retrieval of device credentials and administrative features that can be leveraged for remote code execution through alert templates. Any LibreNMS deployment running a version prior to 26.8.0 is affected, particularly instances whose REST API is reachable by untrusted clients. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates a 0.6% probability of exploitation within 30 days.

What to do: Upgrade to LibreNMS 26.8.0 or later. Until patched, restrict access to the REST API to trusted source addresses via firewall or reverse-proxy rules and review API logs for requests using numeric token values. Because the bypass can expose stored device credentials and enable RCE via alert templates, consider rotating device credentials (such as SNMP communities) on exposed instances if compromise is suspected.