CVE-2026-86426

Executive Summary

CVE-2026-86426 is a critical authentication bypass vulnerability (CVSS 9.8) in the LibreNMS REST API affecting all versions before 26.8.0. Unauthenticated remote attackers can bypass API authentication by exploiting MySQL type coercion—submitting small integer token values (0–9) that are coerced to match stored token hashes—thereby gaining access to protected endpoints including device credentials and administrative functionality that enables remote code execution through alert templates. Given the network-exposed nature of LibreNMS monitoring instances and the low attack complexity, this vulnerability poses an immediate, severe risk to any organization running an unpatched deployment with an internet- or network-reachable API.

Technical Analysis

LibreNMS is an open-source, auto-discovering network monitoring platform widely deployed to manage routers, switches, firewalls, and servers. It exposes a REST API used both by its own web UI and by external integrations for device management, inventory retrieval, and administrative automation.

The vulnerability resides in the REST API authentication layer, which derives from CWE-287 (Improper Authentication). The root cause is unsafe interaction between application-level token validation and backend MySQL query behavior. The API's authentication routine accepts a client-supplied API token and compares it against stored token data. When the supplied value is a small integer (0 through 9) rather than a properly formatted string token, MySQL's loose type coercion causes the integer to be evaluated as numerically equal to a stored token hash during the comparison. Because the application does not strictly type-check or cast the incoming token to a string before comparison, the attacker-controlled integer satisfies the authentication predicate, and the request is treated as authenticated.

This is a classic type-juggling / type-coercion defect at the database comparison layer. The attack does not require a valid token, credentials, or any prior reconnaissance of token values. The attacker need only send a request to a protected API endpoint with a token parameter set to a small integer. The NVD description explicitly identifies the exploitable input range as "small integers like 0 through 9."

Successful authentication bypass exposes the full surface of protected API functionality, which the description states includes device credentials and administrative features. Critically, the administrative functionality reachable post-bypass includes alert template management. LibreNMS alert templates can contain executable logic, and the ability to modify and trigger alert templates enables command execution on the monitoring host—elevating a pure authentication bypass into a remote code execution condition. This chain explains the CVSS impact triad of Confidentiality:High / Integrity:High / Availability:High: the attacker can read stored credentials (C), modify device configs and templates (I), and disrupt monitoring/trigger arbitrary actions (A).

Affected versions are all LibreNMS releases before 26.8.0. No configuration workaround is documented by the vendor; the fix is version-based.

Note: The NVD description does not disclose specific endpoint paths, parameter names, or source file locations. This report therefore describes the vulnerability at the mechanism and class level without inventing implementation identifiers. No public exploit code is confirmed per the provided intelligence (Exploit Code: NO), though PoC status is listed as Public.

Exploitation Scenarios

Because the provided intelligence does not include a verbatim endpoint path or parameter name, the following chain is described at the vulnerability-class level, consistent with the NVD description. Where the description supplies specifics (integer token values 0–9, MySQL coercion, alert templates), those are used directly.

1) Reconnaissance / Target Identification An attacker identifies exposed LibreNMS instances—commonly reachable on standard web ports—using internet-wide scanning services or targeted discovery. LibreNMS instances are frequently deployed as network-management appliances reachable from corporate networks or, in misconfigurations, the public internet. Attackers fingerprint the application via its distinctive login page, HTTP response headers, or favicon. No authentication is needed to reach the REST API surface.

2) Triggering the Flaw Class (Authentication Bypass via Type Coercion) With a target identified, the attacker sends requests to a protected REST API endpoint, supplying an API token value that is a small integer (0–9) instead of a valid string token. The description states the mechanism explicitly: sending numeric values instead of string tokens causes MySQL type coercion, in which the small integer is matched against the token hash. The application fails to enforce string typing, the comparison evaluates true, and the bypassed request is authorized. The attacker iterates over the small integer space if needed—an extremely low-cost operation given the described range of 0 through 9.

3) Post-Authentication API Access and Payload Delivery Once authenticated via the bypass, the attacker gains access to protected API functionality. Per the description, this includes retrieval of device credentials and access to administrative features. The attacker leverages administrative functionality to interact with alert templates. By creating or modifying an alert template and triggering its execution through normal alerting behavior, the attacker achieves remote code execution on the LibreNMS host—a post-authentication code-execution path enabled by the bypass.

4) Post-Exploitation Impact With code execution on the monitoring server, the attacker can: exfiltrate stored device credentials harvested from the API, pivot into monitored network infrastructure using those credentials, persist on the host, and disable or falsify monitoring/alerting to conceal further activity. Because LibreNMS often holds privileged credentials for large device fleets, the blast radius extends well beyond the single host.

No public PoC was confirmed in the supplied intelligence; the exploit code flag is NO. The attack chain above is inferred from the described vulnerability class and the explicit details in the NVD description (numeric token coercion and alert-template code execution).

Impact Assessment

• Attack Vector / Complexity / Privileges (AV:N / AC:L / PR:N / UI:N): Exploitable remotely over the network with low complexity, no privileges, and no user interaction. Any network-reachable instance is a candidate target.
• Confidentiality:High: The API exposes device credentials; bypass grants access to this sensitive data.
• Integrity:High: Administrative access permits modification of device records, configurations, and alert templates.
• Availability:High: Administrative and code-execution capabilities allow disruption of the monitoring platform and, indirectly, of the monitored estate.
• Business Impact: LibreNMS is used for network operations and observability. Compromise yields harvested infrastructure credentials, network pivoting potential, and loss of monitoring integrity—enabling attackers to operate undetected. The alert-template RCE path means a monitoring appliance becomes an initial-access and code-execution foothold inside the enterprise network.

CVSS v3.1 base score: 9.8 (Critical). EPSS is 0.01405 (~1.4%, 71.3rd percentile)—moderate exploit likelihood based on current telemetry, but the combination of public PoC status, trivial attack complexity, and RCE potential warrants treating this as high urgency regardless of EPSS. CISA KEV: NO (not currently listed).

Detection Guidance

Sigma Rule

title: LibreNMS REST API Authentication Bypass via Integer Token Coercion
id: 8f4c2a91-7d3e-4b6a-9c1f-2e5a0b7d6c33
status: experimental
description: Detects attempts to bypass LibreNMS REST API authentication by supplying
  small integer token values (0-9) instead of string tokens, exploiting MySQL type coercion.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-86426
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-query|contains:
      - 'token='
  selection_numeric_token:
    cs-uri-query|re: '(?i)token=[0-9](\b|&|$)'
  condition: selection_path and selection_numeric_token
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-method
  - sc-status
falsepositives:
  - Legitimate clients with malformed tokens (rare)
level: high

YARA Rule

rule CVE_2026_86426_LibreNMS_IntToken_Bypass
{
    meta:
        author = "valtersit.com"
        description = "Detects HTTP request artifacts attempting LibreNMS API auth bypass via numeric token coercion"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-86426"
        date = "2026-01-01"

    strings:
        $api = "LibreNMS" nocase
        $tok = "token=" nocase
        $num0 = "token=0"
        $num1 = "token=1"
        $num2 = "token=2"
        $num3 = "token=3"
        $num4 = "token=4"
        $num5 = "token=5"
        $num6 = "token=6"
        $num7 = "token=7"
        $num8 = "token=8"
        $num9 = "token=9"

    condition:
        $api and $tok and any of ($num*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-86426 LibreNMS REST API Auth Bypass via Numeric Token Coercion"; flow:established,to_server; http.uri; content:"token="; nocase; pcre:"/token=[0-9](\b|&|$)/i"; classtype:attempted-admin; reference:cve,2026-86426; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-86426; sid:202686426; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [http where url.query contains "token=" and url.query regex~ "token=[0-9](\\b|&|$)"]
  [http where http.response.status_code == 200 and
     (url.path contains "/api/" )]

Splunk SPL Query

index=web sourcetype=access_combined
| eval token_val = replace(uri_query, ".*token=([0-9]+).*", "\1")
| where match(uri_query, "(?i)token=[0-9](\b|&|$)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(status) as statuses by src_ip, token_val
| where count > 0
| sort - count
| table src_ip, token_val, paths, statuses, count, first_seen, last_seen

Wazuh OSSEC Rule

<group name="librenms,web,attack,">
  <rule id="2026864" level="12">
    <if_sid>31100</if_sid>
    <field name="url">token=</field>
    <regex type="pcre2">(?i)token=[0-9](\b|&amp;|$)</regex>
    <description>CVE-2026-86426 - LibreNMS REST API authentication bypass attempt using numeric token coercion</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_bypass,cve_2026_86426,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY) — two independent sources (NVD, OSV) confirm the fix.

1) Immediate Mitigations

• Upgrade LibreNMS to 26.8.0 or later at the earliest opportunity; this is the only vendor-documented remediation.
• Until patched, restrict network access to the LibreNMS REST API to trusted management networks only. Do not expose the API to untrusted networks.
• Enforce strict string typing on any token comparison in custom integrations and reject non-string token parameters at the reverse-proxy/WAF layer where feasible (e.g., reject token= values that are pure integers).
• Rotate all LibreNMS API tokens and any device credentials stored in the instance, on the assumption they may be exposed.

2) Patch / Upgrade Steps

• Back up the instance and database.
• Follow the project's standard upgrade procedure to 26.8.0 (or current stable).
• Verify the API rejects numeric token values post-upgrade with a controlled test request.
• Re-issue/rotate tokens after upgrade.

3) Long-Term Hardening

• Enforce parameterized, strictly typed database comparisons in the authentication path (bind token values explicitly as strings).
• Segregate monitoring management planes from general user networks; place LibreNMS behind authentication-aware reverse proxies with MFA.
• Audit and restrict alert-template permissions; alert templates capable of command execution should require elevated, audited access.
• Continuously monitor API access for anomalous numeric-token patterns using the detection rules above.
• Maintain an SBOM/dependency inventory and subscribe to vendor security advisories.

References

1. NVD — CVE-2026-86426: https://nvd.nist.gov/vuln/detail/CVE-2026-86426
2. OSV — LibreNMS vulnerability entry (package: /, affected < 26.8.0)
3. LibreNMS Project — official repository and release notes for 26.8.0: https://github.com/librenms/librenms
4. CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
5. CISA Known Exploited Vulnerabilities Catalog (check for CVE-2026-86426 listing status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild / threat actor note: The supplied intelligence indicates a Public PoC status but does not confirm exploit code availability (Exploit Code: NO) and CISA KEV status is NO. No specific threat actor campaign is attributable from the provided data.