CVE-2026-108715 librenms CVE debrief

Who should care

LibreNMS users and administrators should assess exposure and verify user permissions to prevent unauthorized access through the Smokeping Graph feature. This includes reviewing current user permissions, monitoring for suspicious graph requests, and ensuring that only authorized users have access to latency data and device information. Additionally, security teams and vulnerability management teams should prioritize patching or mitigating this vulnerability

Why it matters

LibreNMS users and administrators should assess exposure of Smokeping Graph feature, verify user permissions, and monitor for suspicious graph requests to prevent unauthorized access.

• View latency data for arbitrary device ids
• Enumerate device names through smokeping_in or smokeping_out graphs

Technical summary

The vulnerability exists in includes/html/graphs/smokeping/auth.inc.php of LibreNMS through 26.9.1.1. The Smokeping Graph feature improperly checks the src probe device instead of the rendered target device, leading to an authorization bypass. This allows restricted users permitted on a probe device to request smokeping_in or smokeping_out graphs with arbitrary device ids, potentially exposing latency data and enabling device name enumeration. The issue highlights the need for stricter access controls and monitoring of graph requests.

Defensive priority

Assess exposure of Smokeping Graph feature, verify user permissions, and monitor for suspicious graph requests.

Recommended defensive actions

• Assess exposure of Smokeping Graph feature
• Verify user permissions
• Monitor for suspicious graph requests
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Plan vendor-supported updates or mitigations

Evidence notes

The CVE Program record and NIST NVD detail page provide information on the authorization bypass vulnerability in LibreNMS through 26.9.1.1. The vulnerability exists in the Smokeping Graph feature, specifically in the auth.inc.php file. The official CVE record and source-specific vulnerability assessment from NIST NVD provide details on the vulnerability, including its potential impact and affected versions. However, the exact scope of affected deployments and specific exploitation attempts remain unknown. Defenders should verify user

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.