Vulnerability · Published Feb 20, 2026 · Assigned by GitHub_M
CVE-2026-26988LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream
Critical 9.3
In plain English
A critical-severity SQL injection in librenms from librenms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.4% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The application fails to properly sanitize or parameterize user input when processing IPv6 address searches. Specifically, the address parameter is split into an address and a prefix, and the prefix portion is directly concatenated into the SQL query string without validation. This allows an attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access or database manipulation. This issue has been fixed in version 26.2.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | librenms/librenms | 26.2.0 | GHSA-h3rv-q4rq-pqcv |
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/librenms/librenms/security/advisories/GHSA-h3rv-q4rq-pqcv x_refsource_CONFIRM
- https://github.com/librenms/librenms/pull/18777 x_refsource_MISC
- https://github.com/librenms/librenms/commit/15429580baba03ed1dd377bada1bde4b7a1175a1 x_refsource_MISC