LibreNMS - Authentication Bypass (CVE-2026-86426)
Description
LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to match token hashes, gaining access to API functionality including device credentials and administrative features that enable remote code execution through alert templates.
psychologyCrowdSec Analysis
CVE-2026-86426 is a critical authentication bypass vulnerability in LibreNMS versions before 26.8.0 that allows unauthenticated attackers to access protected REST API endpoints by submitting numeric values in place of string tokens. Successful exploitation can expose device credentials and administrative functionality, potentially enabling remote code execution through malicious alert templates and resulting in complete compromise of the monitoring system.
CrowdSec has been tracking this vulnerability and its exploits since 17th of September 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-86426 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target the LibreNMS REST API endpoint /api/v0/devices with unauthenticated JSON requests, supplying numeric or array-like api_token values to exploit token-validation type confusion. Successful exploitation returns protected device data in a JSON response containing "status":"ok" and "devices".
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-09-07 |
| Rule Released | 2026-09-17 |
| CrowdSec First Seen | 2026-09-19 |