Skip to content
OpenAdvisories
Critical · 9.3 Public exploit CVE-2026-26988 EUVD-2026-8039GHSA-h3rv-q4rq-pqcv

LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream

Published Feb 20, 2026 · Updated Feb 20, 2026 · Assigned by GitHub_M

Vendor: librenms Product: librenms Package: librenms/librenms Ecosystem: Packagist

Description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The application fails to properly sanitize or parameterize user input when processing IPv6 address searches. Specifically, the address parameter is split into an address and a prefix, and the prefix portion is directly concatenated into the SQL query string without validation. This allows an attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access or database manipulation. This issue has been fixed in version 26.2.0.

Affected products

VendorProductAffectedFixed
librenms librenms < 26.2.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist librenms/librenms < 26.2.0 26.2.0 GHSA-h3rv-q4rq-pqcv

References