CVE-2026-11587
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Centreon contains an SQL injection vulnerability that allows an authenticated user with access to ACL management to read and modify the Centreon database. The flaw enables manipulation of database data beyond the user's intended permissions.
Risk Assessment
A user with ACL management access could read or modify data in the Centreon database, potentially impacting confidentiality and integrity of monitoring configuration and credential data. Exploitation requires authentication and specific privileges.
Recommendation
Update Centreon to a version containing the fix and restrict ACL management privileges to trusted administrators only.
Other vulnerabilities in Centreon
See all- CVE-2026-14453Critical
A critical Server-Side Template Injection (SSTI) vulnerability in Centreon's centreon-open-tickets module. The message_confirm field is stored unsanitized and rendered via Smarty without security policy, allowing any authenticated user to inject and execute arbitrary code on the server.
- CVE-2021-27676Medium
Centreon version 20.10.2 is affected by a stored XSS vulnerability. The dep_description and dep_name parameters are vulnerable to script injection, requiring login and navigation to Configuration > Notifications > Hosts.
Original NVD description (English source)
SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database
Vulnerability data from NVD (NIST) · CISA KEV · EPSS