CVE-2026-26990

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26990", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-17T01:41:24.606Z", "datePublished": "2026-02-20T01:29:33.838Z", "dateUpdated": "2026-02-20T15:34:46.036Z"}, "containers": {"cna": {"title": "LibreNMS has Time-Based Blind SQL Injection in address-search.inc.php", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/librenms/librenms/security/advisories/GHSA-79q9-wc6p-cf92", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/librenms/librenms/security/advisories/GHSA-79q9-wc6p-cf92"}, {"name": "https://github.com/librenms/librenms/pull/18777", "tags": ["x_refsource_MISC"], "url": "https://github.com/librenms/librenms/pull/18777"}, {"name": "https://github.com/librenms/librenms/commit/15429580baba03ed1dd377bada1bde4b7a1175a1", "tags": ["x_refsource_MISC"], "url": "https://github.com/librenms/librenms/commit/15429580baba03ed1dd377bada1bde4b7a1175a1"}], "affected": [{"vendor": "librenms", "product": "librenms", "versions": [{"version": "< 26.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-20T01:29:33.838Z"}, "descriptions": [{"lang": "en", "value": "LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses. This vulnerability requires authentication and is exploitable by any authenticated user. This issue has been fixedd in version 26.2.0."}], "source": {"advisory": "GHSA-79q9-wc6p-cf92", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T15:29:14.167811Z", "id": "CVE-2026-26990", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:34:46.036Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26990", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-20T15:29:14.167811Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:29:16.003Z"}}], "cna": {"title": "LibreNMS has Time-Based Blind SQL Injection in address-search.inc.php", "source": {"advisory": "GHSA-79q9-wc6p-cf92", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "librenms", "product": "librenms", "versions": [{"status": "affected", "version": "< 26.2.0"}]}], "references": [{"url": "https://github.com/librenms/librenms/security/advisories/GHSA-79q9-wc6p-cf92", "name": "https://github.com/librenms/librenms/security/advisories/GHSA-79q9-wc6p-cf92", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/librenms/librenms/pull/18777", "name": "https://github.com/librenms/librenms/pull/18777", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/librenms/librenms/commit/15429580baba03ed1dd377bada1bde4b7a1175a1", "name": "https://github.com/librenms/librenms/commit/15429580baba03ed1dd377bada1bde4b7a1175a1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses. This vulnerability requires authentication and is exploitable by any authenticated user. This issue has been fixedd in version 26.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-20T01:29:33.838Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26990", "state": "PUBLISHED", "dateUpdated": "2026-02-20T15:34:46.036Z", "dateReserved": "2026-02-17T01:41:24.606Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-20T01:29:33.838Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "librenms", "vendor": "librenms", "versions": [{"status": "affected", "version": "< 26.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*", "matchCriteriaId": "C0838E1C-0369-4B31-9B51-83A5D2A7CAC9", "versionEndExcluding": "26.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses. This vulnerability requires authentication and is exploitable by any authenticated user. This issue has been fixedd in version 26.2.0."}, {"lang": "es", "value": "LibreNMS es una herramienta de monitorizaci\u00f3n de red basada en PHP/MySQL/SNMP con autodescubrimiento. Las versiones 25.12.0 e inferiores tienen una vulnerabilidad de inyecci\u00f3n SQL ciega basada en tiempo en address-search.inc.php a trav\u00e9s del par\u00e1metro address. Cuando se proporciona un prefijo de subred manipulado, el valor del prefijo se concatena directamente en una consulta SQL sin una vinculaci\u00f3n de par\u00e1metros adecuada, permitiendo a un atacante manipular la l\u00f3gica de la consulta e inferir informaci\u00f3n de la base de datos a trav\u00e9s de respuestas condicionales basadas en tiempo. Esta vulnerabilidad requiere autenticaci\u00f3n y es explotable por cualquier usuario autenticado. Este problema ha sido solucionado en la versi\u00f3n 26.2.0."}], "id": "CVE-2026-26990", "lastModified": "2026-06-17T10:26:29.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26990", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T15:29:14.167811Z", "version": "2.0.3"}}]}, "published": "2026-02-20T02:16:54.870", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/librenms/librenms/commit/15429580baba03ed1dd377bada1bde4b7a1175a1"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/librenms/librenms/pull/18777"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/librenms/librenms/security/advisories/GHSA-79q9-wc6p-cf92"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "librenms", "source": "cna", "vendor": "librenms"}, "product": "librenms", "vendor": "librenms"}], "created": "2026-02-20T09:52:59.969449+00:00", "updated": "2026-10-25T22:00:15.317476+00:00", "vendors": ["librenms", "librenms$PRODUCT$librenms"]}