CVE-2026-26988 is a critical (CVSS 9.1) SQL injection in LibreNMS versions 25.12.0 and below, in the ajax_table.php endpoint's IPv6 address search. LibreNMS 26.2.0 fixes it. Upgrade to the fixed release, and until you can, limit who can reach the web interface to trusted networks.
What's affected
LibreNMS 25.12.0 and below. The prefix part of the address parameter is joined into a SQL query without validation. The fix is in 26.2.0, per the record and the project's advisory GHSA-h3rv-q4rq-pqcv.
How to check if you're exposed
Find your running version in the LibreNMS web interface or, if you installed from git, in the checkout:
cd /opt/librenms && git describe --tags
Anything at or below 25.12.0 is affected. Also check who can reach the interface, since a network monitoring console often has a wide view of your estate.
What to do now
- Upgrade LibreNMS to 26.2.0 or later using your normal update path.
- Restrict the web interface to management networks or a VPN.
- Review web logs for odd requests to ajax_table.php with long or strange address values.
- Check the database account LibreNMS uses and keep its rights narrow.
- Rotate SNMP community strings and API tokens stored in LibreNMS if you suspect probing.
Why it matters
The class is CWE-89, SQL injection. The application split an address into address and prefix parts and put the prefix directly into the query string. Splitting input does not clean it, and each piece needs the same care as the whole.
LibreNMS stores credentials and topology for the devices it watches. A flaw that reads or alters its database exposes more than the monitoring data itself. The record does not mark this CVE as known exploited.
Quick check
Which version fixes it?
LibreNMS 26.2.0, according to the record.
Sources
- CVE-2026-26988 on Gold
- Project advisory listed in the record: https://github.com/librenms/librenms/security/advisories/GHSA-h3rv-q4rq-pqcv
- Fix pull request listed in the record: https://github.com/librenms/librenms/pull/18777
Last reviewed: 19 October 2026.
