CVE-2026-26988
📋 TL;DR
This SQL injection vulnerability in LibreNMS allows attackers to execute arbitrary SQL commands through the ajax_table.php endpoint when searching IPv6 addresses. Attackers could potentially access, modify, or delete database contents. All LibreNMS installations running versions 25.12.0 or below are affected.
💻 Affected Systems
- LibreNMS
📦 What is this software?
Librenms by Librenms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including credential theft, data destruction, or remote code execution via database functions.
Likely Case
Unauthorized data access and extraction of sensitive monitoring data, configuration information, or user credentials.
If Mitigated
Limited impact with proper network segmentation, database permissions, and input validation in place.
🎯 Exploit Status
Exploitation requires authenticated access to the LibreNMS web interface. The vulnerability is in a commonly used search function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 26.2.0
Vendor Advisory: https://github.com/librenms/librenms/security/advisories/GHSA-h3rv-q4rq-pqcv
Restart Required: No
Instructions:
1. Backup your LibreNMS installation and database. 2. Update LibreNMS to version 26.2.0 or later using git: 'git pull origin master'. 3. Run database updates if required: './daily.sh'. 4. Verify the fix by checking the version.
🔧 Temporary Workarounds
Restrict access to ajax_table.php
linuxBlock or restrict access to the vulnerable endpoint using web server configuration or firewall rules.
# Apache: <Location "/ajax_table.php"> Require all denied </Location>
# Nginx: location = /ajax_table.php { deny all; }
🧯 If You Can't Patch
- Implement strict input validation for IPv6 address searches at the application level.
- Apply network segmentation to isolate the LibreNMS server and restrict database access.
🔍 How to Verify
Check if Vulnerable:
Check if your LibreNMS version is 25.12.0 or below and if the ajax_table.php endpoint is accessible.Check Version:
grep "\$config\['version'\]" config.php | cut -d"'" -f4Verify Fix Applied:
Verify that LibreNMS version is 26.2.0 or later and test IPv6 address searches in the interface.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by ajax_table.php access
- Suspicious IPv6 address patterns in web logs
Network Indicators:
- Unusual database connections from the LibreNMS server
- SQL error messages in HTTP responses
SIEM Query:
source="web_logs" AND uri="/ajax_table.php" AND (query LIKE "%IPv6%" OR query LIKE "%prefix%")