CVE-2026-84990

Executive Summary

CVE-2026-84990 is an authorization flaw (CWE-200, exposure of sensitive information) in ntopng, a web-based network traffic monitoring application. Prior to version 6.7.260718, any authenticated non-administrator user can list and download system-configuration backups via the REST v2 endpoints list_available_backups.lua and download_backup.lua, because those scripts omit an administrator privilege check. The exported backups include the ntopng.user.* Redis key space, potentially disclosing local user password hashes, API tokens, TOTP secrets, and WebAuthn credential data — enabling privilege escalation and account compromise. The CVSS v3.1 base score is 8.8 (High).

Technical Analysis

The vulnerability resides in the REST v2 API surface of ntopng exposed under scripts/lua/rest/v2/get/system/configurations/. Two specific endpoints are affected:

• list_available_backups.lua — allows an authenticated non-admin user to enumerate available system-configuration backups.
• download_backup.lua — allows an authenticated non-admin user to download those backups.

According to the NVD description, the core defect is a missing administrator check on these endpoints. Functionally, any authenticated user — regardless of role — can reach the backup enumeration and retrieval flow. The download path reaches backup_config.export_backup, and the prefs dump logic in prefs_dump_utils.build_prefs_dump_table includes the ntopng.user.* Redis key space in the generated backup. Because that key space holds authentication-relevant material (local user password hashes, and where configured, API tokens, TOTP secrets, and WebAuthn credentials), downloading the backup effectively yields credential material for accounts in the deployment.

The root cause is best characterized as a broken access control / missing function-level authorization issue (mapped to CWE-200 because the demonstrated impact is sensitive information exposure). The attack surface is the authenticated web (REST) interface. Exploitation requires only a valid low-privilege account; no administrative rights, no UI interaction, and no elevated network position are required (AV:N/AC:L/PR:L/UI:N). The confidentiality, integrity, and availability impacts are all High per the vector — confidentiality is directly impacted by the credential disclosure, while the integrity/availability ratings reflect the potential for full account takeover (including admin) using recovered or usable credentials.

Note: the CVSS vector's I:H/A:H reflect the assessor's judgment of downstream account-compromise potential; technically the flaw itself is a read/exfiltration defect. No public PoC or exploit code is available, and no vulnerability-class code reconstruction beyond the functions/paths named in the NVD description is asserted here.

Exploitation Scenarios

No public PoC exists; the chain below is derived strictly from the NVD description and the disclosed code flow.

1. Reconnaissance / target identification Identify an internet- or intranet-exposed ntopng instance running a version prior to 6.7.260718. This is a web application, so discovery is via standard HTTP fingerprinting of the ntopng login/interface. An attacker needs a single valid, non-privileged account — obtained through phishing, credential reuse, a low-privilege service account, or by abusing default/first-run accounts where applicable.

2. Triggering the flaw Authenticate as the non-admin user. Invoke the REST v2 endpoints under scripts/lua/rest/v2/get/system/configurations/:

   • First, call list_available_backups.lua to enumerate existing backups.
   • Then, call download_backup.lua to retrieve a backup file. Neither endpoint enforces an administrator check, so the low-privilege session is sufficient.

3. Payload / execution method This is not a code-execution vulnerability; the "payload" is the backup file itself. The download path reaches backup_config.export_backup, and the dump produced via prefs_dump_utils.build_prefs_dump_table includes the ntopng.user.* Redis key space. The attacker extracts authentication material from the backup:

   • local user password hashes,
   • API tokens (when configured),
   • TOTP secrets (when configured),
   • WebAuthn credential data (when configured).

4. Post-exploitation impact Recovered or recoverable credentials enable account compromise. Password hashes may be cracked offline or, depending on dump format/algorithm, used directly. API tokens, TOTP secrets, and WebAuthn credential data enable session/API authentication and MFA bypass or cloning. Using a compromised privileged account, the attacker can escalate from the initial low-privilege foothold to administrative control of the ntopng deployment and, from there, pivot into the monitored network environment. Because ntopng sits in traffic-monitoring positions, downstream impact can extend to visibility and integrity of network telemetry.

Impact Assessment

Business impact is significant for any organization exposing ntopng to untrusted or semi-trusted users. The flaw grants a low-privileged authenticated user access to authentication secrets for the entire local user base, including administrative accounts. Successful exploitation can lead to full administrative takeover of the monitoring platform and lateral movement into the monitored environment.

• Confidentiality: High — direct disclosure of password hashes and, where configured, API tokens, TOTP secrets, and WebAuthn credential data (ntopng.user.*).
• Integrity: High — attacker can operate as compromised accounts, including administrators, altering configuration and platform state.
• Availability: High — administrative compromise permits disabling or reconfiguring the monitoring service.

Blast radius: every locally defined ntopng user whose credentials are captured in a downloadable backup. Exposure is highest for internet-facing instances; internal instances remain at risk from any user with a valid low-privilege login. CISA KEV: NO. EPSS: not yet scored by FIRST.org. No exploit code or Nuclei template is publicly available, but the low complexity (AC:L) and the presence of exactly-specified endpoints make exploitation straightforward for a motivated insider or any holder of a low-privilege account.

Detection Guidance

Sigma Rule

title: ntopng Non-Admin Backup Listing or Download Attempt (CVE-2026-84990)
id: 7b1c9f3a-2d4e-4a6b-9c1f-0e2a5b8d6c41
status: experimental
description: Detects access to ntopng REST v2 configuration backup endpoints by non-admin authenticated users, consistent with CVE-2026-84990.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84990
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: ntopng
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua'
      - '/scripts/lua/rest/v2/get/system/configurations/download_backup.lua'
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  condition: selection_endpoint and selection_method
fields:
  - c-ip
  - cs-uri-stem
  - cs-username
falsepositives:
  - Legitimate administrator performing backup maintenance
level: high
tags:
  - attack.t1190
  - cve.2026.84990

YARA Rule

rule CVE_2026_84990_ntopng_Backup_Access
{
    meta:
        description = "Detects HTTP requests targeting ntopng system-configuration backup endpoints (CVE-2026-84990)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84990"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ep1 = "list_available_backups.lua" ascii wide nocase
        $ep2 = "download_backup.lua" ascii wide nocase
        $path = "rest/v2/get/system/configurations" ascii wide nocase
        $ua = "ntopng" ascii wide nocase

    condition:
        (any of ($ep1, $ep2)) and $path
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84990 ntopng Non-Admin Backup Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/scripts/lua/rest/v2/get/system/configurations/"; http.uri; content:"list_available_backups.lua"; nocase; sid:2026849901; rev:1;)
alert http any any -> any any (msg:"CVE-2026-84990 ntopng Non-Admin Backup Download Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/scripts/lua/rest/v2/get/system/configurations/"; http.uri; content:"download_backup.lua"; nocase; sid:2026849902; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ http where url.path : "/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua" and http.request.method : "GET" ]
  [ http where url.path : "/scripts/lua/rest/v2/get/system/configurations/download_backup.lua" and http.request.method : "GET" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access OR sourcetype=apache:access
| search uri_path IN (
    "/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua",
    "/scripts/lua/rest/v2/get/system/configurations/download_backup.lua")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as endpoints by src_ip, user, status
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="ntopng,web,cve-2026-84990,">
  <rule id="2026849" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua</url>
    <description>CVE-2026-84990: ntopng non-admin access to backup listing endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_84990,access_control,</group>
  </rule>

  <rule id="2026850" level="13">
    <decoded_as>web-accesslog</decoded_as>
    <url>/scripts/lua/rest/v2/get/system/configurations/download_backup.lua</url>
    <description>CVE-2026-84990: ntopng non-admin system-configuration backup download attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_84990,credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Note: the NVD description states the issue is fixed in version 6.7.260718; however, no vendor advisory or patch reference has been confirmed in tracked sources, so the fix status above must be treated as unconfirmed and verified directly with the vendor.

1. Immediate mitigations

• Restrict network access to the ntopng web interface (firewall/ACL, VPN-only, or reverse-proxy allowlists) so that only trusted administrators can reach it.
• Where the deployment allows it, disable or remove non-administrator accounts; ensure every account able to authenticate is trusted.
• Block access at the reverse proxy / WAF to the affected paths: /scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and /scripts/lua/rest/v2/get/system/configurations/download_backup.lua for non-admin sessions.
• Rotate all potentially disclosed secrets as a precaution if a low-privilege account could have been in use: local user password hashes → force password resets; revoke and reissue API tokens; re-enroll TOTP; re-register WebAuthn credentials.
• Review ntopng access logs for requests to those endpoints from unexpected accounts/source IPs.

2. Patch / upgrade steps

• Upgrade ntopng to 6.7.260718 or later as indicated by the NVD description, after validating the release with the vendor.
• Prior to upgrade, take a controlled backup and note the presence of the ntopng.user.* key space handled by prefs_dump_utils.build_prefs_dump_table.
• After upgrade, re-test that a non-admin account can no longer list or download backups.
• If the upgrade cannot be performed immediately, keep the proxy-level blocks above in place until it can.

3. Long-term hardening

• Enforce server-side role/authorization checks on every administrative REST v2 endpoint; adopt a default-deny authorization model for /scripts/lua/rest/v2/get/system/configurations/.
• Separate privileged operations so that secrets (password hashes, API tokens, TOTP secrets, WebAuthn data) are never included in transferable configuration backups, or encrypt backups at rest with keys not exposed to the web tier.
• Apply least privilege to local ntopng accounts and integrate with centralized identity (LDAP/SSO) with MFA.
• Add continuous monitoring/detection (rules above) and periodic authorization regression tests for admin-only endpoints.
• Track vendor releases for the confirmed fix and subscribe to the ntopng security advisories.

References

• NVD — CVE-2026-84990: https://nvd.nist.gov/vuln/detail/CVE-2026-84990
• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• ntopng project (vendor product page / release channel): https://www.ntop.org/products/traffic-analysis/ntopng/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-84990 NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild evidence: No exploit code, PoC, or Nuclei template is publicly available, and the CVE is not listed in CISA KEV. No named threat actor campaigns are associated with this CVE in the provided data. EPSS has not yet been scored by FIRST.org.