LibreNMS: LDAP filter injection leads to authentication bypass
Summary
LibreNMS versions before 26.9.0 insert usernames unescaped into LDAP search filters when the ldap-authorization or ad-authorization login mode is used. Authentication only checks whether the user exists and performs no password bind. If REMOTE_USER is not forwarded by the web server, an unauthenticated attacker can send a wildcard username via HTTP Basic Authorization and gain administrative access.
Affected
- LibreNMS before 26.9.0 with auth_mechanism set to ldap-authorization or ad-authorization
- Exploitation requires that REMOTE_USER is not forwarded by the web server (for example Nginx with PHP-FPM without fastcgi_param REMOTE_USER)
Fixed in
- Upgrade to LibreNMS 26.9.0
- The 26.9.0 release notes list 'Sanitize user and group inputs in LDAP search filters (#20542)', which is likely the fix; the release notes do not name the CVE
- Backports to older branches: Unknown.
Workaround
- No vendor-documented workaround known.
- Switching away from the ldap-authorization or ad-authorization mode removes the vulnerable code path.
- Unverified: a correctly configured web server forwarding REMOTE_USER may change exposure; this has not been confirmed.
Exploitation
- Not known to be exploited in the wild.
- Public proof of concept: unclear; one SSVC data point lists 'poc', while VulDB states no exploit exists.
- Attack requires no credentials, only a crafted Authorization header.
Our recommendation
- Upgrade to LibreNMS 26.9.0 with priority.
- If LDAP or AD authorization is not required, switch to another authentication mode.
- Restrict access to the web interface to the management network or VPN.
- If the instance was exposed while unpatched, check for unexpected admin accounts, API tokens and changed settings.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- GitHub Security Advisory GHSA-7cmx-65c5-8h8v github.com
- OSV entry CVE-2026-109357 osv.dev
- LibreNMS releases github.com
- VulDB entry 417077 vuldb.com
- LibreNMS authentication documentation github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:43.
Original description (NVD)
LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTE_USER is not forwarded, unauthenticated attackers can send a wildcard username via HTTP Basic Authorization (PHP_AUTH_USER) to match all users and groups and gain admin access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.