9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26988

CVE-2026-26988: LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The application fails to properly sanitize or parameterize user input when processing IPv6 address searches. Specifically, the address parameter is split into an address and a prefix, and the prefix portion is directly concatenated into the SQL query string without validation. This allows an attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access or database manipulation. This issue has been fixed in version 26.2.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26988

CVE-2026-26988:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
librenms/librenms	composer	< 26.2.0	26.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security advisory and the associated patch commit 15429580baba03ed1dd377bada1bde4b7a1175a1 reveals a classic SQL injection vulnerability. The root cause was the improper handling of user-supplied input within the includes/html/table/address-search.inc.php script, which was executed via the ajax_table.php endpoint.

The patch completely removes the vulnerable script includes/html/table/address-search.inc.php. The evidence is clear from the diff, which shows the deletion of the file containing the raw SQL query construction. The vulnerable line, $sql .= " AND ipv6_prefixlen = '$prefix'";, demonstrates that the $prefix variable, derived from user input, was not sanitized, allowing an attacker to break out of the SQL string and inject malicious commands.

The fix involved a significant refactoring of the search functionality. The procedural code in ajax_table.php and the included script was replaced with an object-oriented approach using Laravel controllers (Ipv4AddressSearchController, Ipv6AddressSearchController). The new implementation, specifically in App\Http\Controllers\Table\AddressSearchController::applyBaseSearchQuery, utilizes the Eloquent query builder ($q->where($this->cidrField, $cidr);). This modern approach uses parameterized queries, which is the standard defense against SQL injection, thus mitigating the vulnerability.

Vulnerable functions

ajax_table.php

includes/html/table/address-search.inc.php

The vulnerability existed in a script file, `includes/html/table/address-search.inc.php`, which was included and executed by `ajax_table.php`. This script handled address searches. When the `search_type` was 'ipv6', the code would split the user-provided 'address' parameter by '/' and concatenate the second part (the prefix) directly into the SQL query. This lack of sanitization or parameterization allowed for SQL injection.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.