CVE-2026-2751 is a high severity blind SQL injection in Centreon Web on the Central Server, in the Service Dependencies module. The NVD record scores it 8.3. Centreon has fixed it in 25.10.8, 24.10.20 and 24.04.24, so update any Central Server running an older build on those release lines.
What's affected
Centreon Web on a Central Server on Linux, specifically the Service Dependencies modules. The record says the issue affects versions before these three releases:
- 25.10.8
- 24.10.20
- 24.04.24
The vendor bulletin says fixes exist for all supported versions and that these builds include cumulative fixes from earlier updates. The bulletin lists no workaround, so treat the update as the remedy. The record names no exploitation, and the CISA KEV flag is false.
One detail worth knowing: the NVD record gives a CVSS score of 8.3 with a vector requiring low privileges, while the Centreon bulletin shows 8.1. Both sit in the high band. Use either one for triage, but do not treat the gap as a sign the fix differs.
How to check if you're exposed
Find the installed centreon-web package version on your Central Server and compare it to the fixed builds for your release line.
# RPM based installs
rpm -q centreon-web
# Debian based installs
dpkg -l centreon-web
If you run a High Availability platform, the vendor asks you to follow the Centreon HA update procedures rather than updating nodes ad hoc. Also note which accounts can edit service dependencies, because the vector in the record requires an authenticated user with low privileges.
What to do now
- Identify every Central Server and which release line it is on (25.10, 24.10 or 24.04).
- Schedule the update to 25.10.8, 24.10.20 or 24.04.24, or later.
- On HA platforms, follow the Centreon HA update procedures from the bulletin.
- Until you patch, limit who holds rights to configure service dependencies, and review recent changes to dependency objects.
- Check your web and database logs around the Service Dependencies pages for unusual activity during the exposure window.
Why it matters
The bulletin describes the flaw as blind SQL injection through unsanitized array keys when service dependencies are deleted. That is the CWE-89 class: user controlled data ends up inside a SQL statement without being treated as data. Blind means the attacker does not see query output directly and infers it from behaviour, which is slower but still able to read and change records.
A monitoring platform is a good place for an attacker to sit. It holds host inventories, credentials for checks and a view of your network. The record's vector rates confidentiality and integrity impact as high, and availability as low.
Quick check
Does this need admin rights to reach?
The record's vector lists privileges required as low, so an authenticated account is needed. It is still network reachable, so do not leave it for later because the user is trusted.
Sources
Last reviewed: 19 October 2026.
