PT-2026-20905 · Librenms · Librenms

Quirmz · Published 2026-02-18 · Updated 2026-02-25 · CVE-2026-26990

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibreNMS versions 25.12.0 and below

Description LibreNMS is a network monitoring tool. A Time-Based Blind SQL Injection exists in the address-search.inc.php file via the address parameter. Supplying a crafted subnet prefix allows manipulation of SQL query logic and inference of database information through time-based conditional responses. This requires authentication and is exploitable by any authenticated user. The API endpoint involved is address-search.inc.php. The vulnerable parameter is address.

Recommendations Update to version 26.2.0 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-26990

GHSA-79Q9-WC6P-CF92

Affected Products

Librenms

References · 14

• 🔥 https://github.com/librenms/librenms/security/advisories/GHSA-79q9-wc6p-cf92 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26990.json · Exploit
• https://github.com/librenms/librenms/commit/15429580baba03ed1dd377bada1bde4b7a1175a1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-26990 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26990 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-79q9-wc6p-cf92 · Vendor Advisory
• https://github.com/librenms/librenms · Note
• https://github.com/librenms/librenms/pull/18777 · Note
• https://twitter.com/VulmonFeeds/status/2024689082303947082 · Twitter Post
• https://twitter.com/CveFindCom/status/2024834929410859186 · Twitter Post
• https://twitter.com/cracbot/status/2026613209508229434 · Twitter Post
• https://t.me/CVEtracker/45231 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1r91qgc/resumen_diario_de_vulnerabilidades_19022026 · Reddit Post
• https://twitter.com/TheHackerWire/status/2024669969955639791 · Twitter Post