CVE-2026-109357

Katalog CVE

CVSS 8.1 · High EPSS 0,46%

Kerentanan Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'). Skor CVSS 3.1 8.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTE_USER is not forwarded, unauthenticated attackers can send a wildcard username via HTTP Basic Authorization (PHP_AUTH_USER) to match all users and groups and gain admin access.

Rincian

Terbit di NVD

12 Oktober 2026

Terakhir diubah

12 Oktober 2026

Status NVD

Received

CVSS 3.1

8.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/librenms/librenms/security/advisories/GHSA-7cmx-65c5-8h8v
• https://www.vulncheck.com/advisories/librenms-before-26.9.0-ldap-filter-injection-authentication-bypass-via-au...