CVE-2026-86426 is an authentication bypass in the LibreNMS REST API (CVSS 9.8, critical). Sending numbers in place of token strings matched stored hashes through MySQL type coercion. LibreNMS 26.8.0 fixes it. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The advisory lists LibreNMS up to 26.7.0, patched in 26.8.0. The weakness is CWE-287, improper authentication.
The API check compared a supplied token with stored values, and a numeric value could match through type coercion. The advisory says an attacker is then treated as the owner of a real token and can read device data, including stored SNMP credentials. If the token belongs to an administrator, the API includes features that can run code on the server. The attack requires at least one enabled API token to exist. The record is not in the CISA KEV catalog.
How to check if you're exposed
Check your LibreNMS version.
cd /opt/librenms && ./lnms --version
If it is 26.7.0 or older, you are affected. Then check whether any API tokens exist in the web interface under API settings. The advisory says an install with no tokens has nothing to match.
What to do now
- Upgrade to LibreNMS 26.8.0 or later.
- List API tokens and delete any you do not use.
- Restrict access to the web interface and API to your management network.
- Rotate SNMP community strings and credentials stored in LibreNMS if the API was reachable by untrusted users.
- Review web server logs for unusual API calls.
Why it matters
In MySQL, comparing a string column with a number converts the string to a number, and a string that starts with letters becomes zero. A single digit can then match a token hash that begins with that digit. The fix is to check the type of the input before the comparison.
Monitoring tools hold credentials for the whole network, which raises the cost of an API bypass beyond the tool itself.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I have a problem if I never created an API token?
The advisory says the bypass matches an existing token, so a system with none has nothing to match. Upgrade anyway.
Sources
Last reviewed: 19 October 2026.
