CVE-2026-26990
HighSummary
LibreNMS to narzędzie do monitorowania sieci oparte na PHP/MySQL/SNMP, które w wersjach 25.12.0 i poniżej ma podatność na Time-Based Blind SQL Injection w pliku address-search.inc.php poprzez parametr address. W przypadku dostarczenia odpowiednio skonstruowanego prefiksu podsieci, wartość prefiksu jest bezpośrednio łączona z zapytaniem SQL bez odpowiedniego powiązania parametrów, co pozwala atakującemu manipulować logiką zapytania i wydobywać informacje z bazy danych poprzez odpowiedzi warunkowe oparte na czasie.
Risk Assessment
Podatność ta wymaga uwierzytelnienia i może być wykorzystana przez każdego uwierzytelnionego użytkownika, co stwarza ryzyko ujawnienia wrażliwych informacji z bazy danych. Może to prowadzić do poważnych konsekwencji dla bezpieczeństwa danych w organizacji.
Recommendation
Zaleca się aktualizację do wersji 26.2.0, w której problem został naprawiony. Dodatkowo, warto przeprowadzić audyt zabezpieczeń, aby zminimalizować ryzyko wykorzystania tej podatności.
Related vulnerabilities
- CVE-2026-87701Critical
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
- CVE-2026-85889Critical
Missing authentication for a critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-85885Critical
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
- CVE-2026-83944Critical
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-77903Critical
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70200Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70009Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69865Critical
Authorization bypass through a user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69399Critical
Elevation of Privilege vulnerability in Azure Arc. Technical details were not provided in the description.
- CVE-2026-76949Critical
A vulnerability in the ash_authentication library (Elixir) allows an attacker who can plant a remember-me cookie in a victim's browser to replace the victim's authenticated session with one for the attacker's own account. The issue stems from a mismatch between the session keys used by the guard and the reader, causing remember-me sign-in to run on every request.
Original NVD description (English source)
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses. This vulnerability requires authentication and is exploitable by any authenticated user. This issue has been fixedd in version 26.2.0.