CVE-2026-86426 LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion

What is CVE-2026-86426?

CVE-2026-86426 is a critical authentication bypass vulnerability in Librenms Librenms, published on 7 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to match token hashes, gaining access to API functionality including device credentials and administrative features that enable remote code execution through alert templates.

Weakness: CWE-287

Which versions are affected by CVE-2026-86426?

It affects 1 product.

Products include Librenms Librenms.

How do I fix CVE-2026-86426?

No fix has been published for CVE-2026-86426 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-86426 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-86426 exists.

Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.

Other vulnerabilities in Librenms Librenms

• CVE-2023-4982 Cross-site Scripting (XSS) - Stored in librenms/librenms Critical 9.8
• CVE-2022-29712 Command injection in librenms Critical 9.8
• CVE-2021-44278 Path traversal in librenms/librenms Critical 9.8
• CVE-2019-10665 LibreNMS Information Disclosure Critical 9.8
• CVE-2018-20434 LibreNMS arbitrary OS commands execution Critical 9.8

All Librenms Librenms vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-84cr-xjpw-q9mc, GHSA-cvq8-gqfq-3mvg.