CVE-2026-109357

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.0

Description An LDAP filter injection exists in ldap-authorization and ad-authorization modes. This occurs because usernames are inserted unescaped into LDAP search filters, and the authentication process only verifies the existence of the user. When REMOTE USER is not forwarded, unauthenticated attackers can use a wildcard username via HTTP Basic Authorization through the PHP AUTH USER variable to match all users and groups, allowing them to gain administrative access.

Recommendations Update LibreNMS to version 26.9.0 or later.