CVE-2026-86426

{
  "etk_id": "ETK-2026-2845",
  "cve_id": "CVE-2026-86426",
  "display_id": "CVE-2026-86426",
  "ghsa_id": "GHSA-84cr-xjpw-q9mc",
  "euvd_id": "EUVD-2026-72384",
  "status": "published",
  "anchor_state": "anchored",
  "title": "REST API authentication bypass in LibreNMS",
  "summary": "LibreNMS releases before 26.8.0 can incorrectly authenticate requests to the REST API. An unauthenticated attacker may access protected API functions, potentially exposing device credentials and administrative capabilities. Exposure requires an affected REST API to be reachable by the attacker.",
  "mitigation": "Upgrade LibreNMS to version 26.8.0 or later. Until upgraded, restrict REST API access to trusted networks and users.",
  "vendor": "librenms",
  "product": "librenms",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 26.7.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "26.8.0"
      ],
      "package_name": "LibreNMS",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.2,
  "cvss_src": "other",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.002702916666666667,
  "t0_at": "2026-09-07T12:53:47.884000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-28T08:11:52.281053+00:00",
      "days": 50.8042175584838,
      "is_lower_bound": false,
      "measured_at": "2026-09-07T12:53:47.884000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-10-28T00:00:00+00:00",
      "days": 51,
      "is_lower_bound": false,
      "measured_at": "2026-09-07T12:53:47.884000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-86426"
    },
    "public_poc": {
      "at": "2026-10-28T08:11:52.293732+00:00",
      "days": 50.80421770523148,
      "is_lower_bound": false,
      "measured_at": "2026-09-07T12:53:47.884000+00:00",
      "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-86426.yaml"
    },
    "trigger_signal": {
      "at": "2026-10-28T00:00:00+00:00",
      "days": 50.46264023148148,
      "is_lower_bound": false,
      "measured_at": "2026-09-07T12:53:47.884000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-86426"
    }
  }
}