CVE-2026-26988: 
PHP vulnerability analysis and mitigation

CVE-2026-26988 is an SQL Injection vulnerability in LibreNMS's ajax_table.php endpoint affecting the IPv6 address search functionality. It affects LibreNMS versions 25.12.0 and below, and was disclosed on February 17, 2026, with a fix released in version 26.2.0. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 9.3 (Critical), exploitable by unauthenticated remote attackers with no user interaction required (GitHub Advisory, LibreNMS Security Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). In the vulnerable ajax_table.php endpoint, when search_type is set to ipv6, the application splits the user-supplied address parameter on the / delimiter using PHP's explode() function, yielding $address and $prefix. The $prefix portion is then directly concatenated into the SQL query string without sanitization or parameterization: $sql .= " AND ipv6_prefixlen = '$prefix'";. Unlike the IPv4 code path, which uses prepared statements with bound parameters, the IPv6 path treats the prefix as a raw string, allowing an attacker to inject a single quote to break out of the SQL string literal and append arbitrary SQL commands (GitHub Advisory, LibreNMS Security Advisory). The fix rewrote the address search backend using dedicated Laravel controller classes with proper parameterized queries (Patch Commit).

Successful exploitation allows an unauthenticated attacker to execute arbitrary SQL commands against the LibreNMS database, leading to unauthorized access to sensitive monitoring data (device credentials, SNMP community strings, network topology, user accounts) and potential manipulation or deletion of database contents. The high confidentiality and integrity impact means an attacker could exfiltrate all stored network management data or corrupt monitoring records, and depending on database configuration, could potentially escalate to operating system command execution via SQL features such as INTO OUTFILE or UDF abuse (GitHub Advisory, LibreNMS Security Advisory).

A public proof-of-concept exploit is available on GitHub at https://github.com/mbanyamer/CVE-2026-26988-LibreNMS-SQLi, published around March 2, 2026 (Feedly). The official security advisory also includes a working PoC payload demonstrating the injection (LibreNMS Security Advisory). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.001% (0th percentile), and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing LibreNMS instances (versions ≤ 25.12.0) using tools like Shodan or Censys by searching for LibreNMS login pages or version banners.
2. Identify the vulnerable endpoint: Target the ajax_table.php endpoint, which handles AJAX table data requests including address searches.
3. Craft the malicious HTTP POST request: Send a POST request to /ajax_table.php with the parameters id=address-search, search_type=ipv6, and a crafted address value containing a / to populate the $prefix variable with SQL-injecting content.
4. Inject SQL payload: Use a payload such as address=snow/1nd'" — the explode('/', ...) call sets $prefix to 1nd'", which breaks out of the SQL string literal: the resulting query fragment becomes AND ipv6_prefixlen = '1nd'"', enabling SQL syntax manipulation.
5. Execute arbitrary SQL: Extend the payload with UNION-based, error-based, or blind SQL injection techniques (e.g., using sqlmap) to enumerate database tables, extract credentials, SNMP strings, or other sensitive data stored in the LibreNMS database (LibreNMS Security Advisory, GitHub Advisory).

• Network: Unusual or repeated HTTP POST requests to /ajax_table.php with search_type=ipv6 and address parameters containing /, single quotes ('), double quotes ("), SQL keywords (UNION, SELECT, OR, AND), or encoded variants thereof; unexpected outbound database connections from the LibreNMS host.
• Logs: Web server access logs (Apache/Nginx) showing POST requests to ajax_table.php with anomalous address parameter values; PHP error logs showing SQL syntax errors or database exceptions triggered by malformed queries; repeated 500 or unusual HTTP response codes from ajax_table.php.
• Application: LibreNMS application logs showing database query errors related to ipv6_prefixlen comparisons; unexpected data modifications or new user accounts in the LibreNMS database.
• Process: Unusual database process activity (e.g., mysqld executing INTO OUTFILE, LOAD_FILE, or UDF calls) originating from the LibreNMS web process (LibreNMS Security Advisory).

Upgrade LibreNMS to version 26.2.0 or later, which rewrites the address search backend using dedicated Laravel controller classes with properly parameterized queries, eliminating the direct string concatenation vulnerability (Patch Commit, GitHub Advisory). For organizations unable to upgrade immediately, implement network segmentation to restrict access to the LibreNMS web interface to trusted management networks only, and deploy a web application firewall (WAF) rule to block POST requests to ajax_table.php containing SQL metacharacters in the address parameter. Monitor web server and database logs for signs of exploitation as described in the IOCs section.

The vulnerability was reported by researcher Snow1nd and published by LibreNMS maintainer murrant on February 17, 2026 (LibreNMS Security Advisory). Coverage appeared on The Hacker Wire and security digest sites shortly after disclosure (The Hacker Wire). A PoC week digest also highlighted the public exploit availability (PoC Week Digest). Community reaction has been focused on the unauthenticated nature of the attack and the availability of public PoC code, underscoring the urgency of patching.