CVE-2026-109357 librenms CVE debrief

Who should care

System administrators using LibreNMS before 26.9.0 with LDAP authentication should assess exposure and prioritize updating to version 26.9.0 or later. The vulnerability allows unauthenticated attackers to gain admin access, which can lead to significant security risks. System administrators should review the CVE record and source item for more information on the vulnerability and its impact.

Why it matters

LibreNMS before 26.9.0 contains an LDAP filter injection vulnerability that allows unauthenticated attackers to gain admin access. System administrators should prioritize updating to version 26.9.0 or later.

• Unauthenticated attackers can gain admin access to affected systems
• LDAP filter injection can lead to authentication bypass
• Systems using LibreNMS before 26.9.0 with LDAP authentication are vulnerable

Technical summary

The vulnerability exists in ldap-authorization and ad-authorization modes of LibreNMS before 26.9.0. Unauthenticated attackers can send a wildcard username via HTTP Basic Authorization to match all users and groups, gaining admin access. The vulnerability is caused by unescaped usernames being inserted into LDAP search filters. This allows attackers to bypass authentication and gain elevated privileges. System administrators should prioritize updating to version 26.9.0 or later to mitigate the vulnerability. The vulnerability has a high impact on system security, allowing attackers to gain admin access.

Defensive priority

High priority for systems using LibreNMS before 26.9.0 with LDAP authentication

Recommended defensive actions

• Update LibreNMS to version 26.9.0 or later
• Restrict access to the HTTP Basic Authorization header
• Monitor for suspicious authentication attempts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and source item provide details on the LDAP filter injection vulnerability in LibreNMS before 26.9.0. The vulnerability is caused by unescaped usernames being inserted into LDAP search filters, allowing unauthenticated attackers to gain admin access. The source item and CVE record provide evidence of the vulnerability and its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.