CVE-2026-26988 LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream
Attackers can inject SQL commands via the IPv6 address search parameter in LibreNMS, leading to unauthorized data access or database manipulation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-26988?
CVE-2026-26988 is a critical SQL injection vulnerability in Librenms Librenms, published on 20 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The application fails to properly sanitize or parameterize user input when processing IPv6 address searches. Specifically, the address parameter is split into an address and a prefix, and the prefix portion is directly concatenated into the SQL query string without validation. This allows an attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access or database manipulation. This issue has been fixed in version 26.2.0.
Weakness: CWE-89
Which versions are affected by CVE-2026-26988?
2 open source packages ship an affected version, including librenms/librenms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
librenms/librenms Packagist | All versions | 26.2.0 |
librenms/librenms Packagist | All versions | 26.2.0 |
Products include Librenms Librenms.
How do I fix CVE-2026-26988?
Upgrade librenms/librenms to 26.2.0 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-26988 being exploited?
There is no known exploitation of CVE-2026-26988 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Librenms Librenms
Sources
Also known as GHSA-h3rv-q4rq-pqcv.