CVE-2026-86427

LibreNMS before 26.8.0 fails to properly neutralize the graph_title parameter, allowing authenticated users to break out of double-quote escaping and inject arbitrary arguments into rrdtool commands (CWE-77). By injecting DEF and LINE arguments, an attacker can read RRD files from devices they are not authorized to view, and via newline injection they can execute additional rrdtool commands, bypassing per-device authorization checks. The CVSS 4.0 score of 8.7 (High) reflects a network-reachable, low-complexity flaw requiring only low privileges (a valid authenticated account) with high confidentiality, integrity, and availability impact on the monitoring host. All LibreNMS deployments running versions prior to 26.8.0 are affected. No public proof-of-concept or in-the-wild exploitation is known, and EPSS estimates only about a 0.3% probability of exploitation within 30 days (25th percentile).

What to do: Upgrade to LibreNMS 26.8.0 or later. Until patched, restrict web UI access to trusted, low-privilege accounts (the flaw requires authentication) and monitor for anomalous rrdtool process invocations or cross-device graph reads. Consider filtering newlines and double-quote characters in graph_title input at a reverse proxy or WAF as a stopgap.