# CVE-2026-86426: LibreNMS - Authentication Bypass

> Live exploitation tracking for CVE-2026-86426 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-86426

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.2
- **Public exploit available:** Yes
- **Affected products:** LibreNMS
- **Weaknesses:** CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
- **Tags:** management_panel, web_application

## Description

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to match token hashes, gaining access to API functionality including device credentials and administrative features that enable remote code execution through alert templates.

## CrowdSec analysis

[CVE-2026-86426](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-86426) is a critical authentication bypass vulnerability in LibreNMS versions before 26.8.0 that allows unauthenticated attackers to access protected REST API endpoints by submitting numeric values in place of string tokens. Successful exploitation can expose device credentials and administrative functionality, potentially enabling remote code execution through malicious alert templates and resulting in complete compromise of the monitoring system.

CrowdSec has been tracking this vulnerability and its exploits since 17th of September 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-86426 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target the LibreNMS REST API endpoint `/api/v0/devices` with unauthenticated JSON requests, supplying numeric or array-like `api_token` values to exploit token-validation type confusion. Successful exploitation returns protected device data in a JSON response containing `"status":"ok"` and `"devices"`.

## Timeline

- 2026-09-07: CVE Published. CVE-2026-86426 is published to NVD.
- 2026-09-17: Rule Released. CrowdSec releases a rule to detect CVE-2026-86426 exploitation attempts against the CrowdSec Network.
- 2026-09-19: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-86426 for the first time.

## References

- https://www.vulncheck.com/advisories/librenms-before-26.8.0-authentication-bypass-via-api-token-type-confusion
- https://github.com/librenms/librenms/security/advisories/GHSA-cvq8-gqfq-3mvg
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-86426.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-86426) follows observed exploitation activity for CVE-2026-86426. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.