LibreNMS versions prior to 26.9.0 suffer from an LDAP filter injection flaw in ldap-authorization and ad-authorization modes. Usernames are inserted directly into LDAP search filters without escaping, and authentication merely confirms user existence. Unauthenticated attackers can exploit this by sending a wildcard username in the HTTP Basic Authorization header when the REMOTE_USER variable is not forwarded, causing the search to match all users and groups. The result is that the attacker can log in with administrative privileges, providing full control over the system.

This vulnerability affects all installations of LibreNMS running a release older than 26.9.0. The affected vendor is librenms and the product name is librenms. No specific sub-versions are listed, so any build prior to 26.9.0 is considered vulnerable.

The CVSS score of 9.2 classifies this flaw as critical. Exploitation requires only the ability to send an HTTP request with a crafted Basic Authorization header; no local privileges or additional credentials are needed. The attack is remote, as it can be performed over the network from any host that can reach the LibreNMS service. The EPSS score is not provided, and the vulnerability is not yet listed in the CISA KEV catalog, but its high severity and ability to grant admin access make it a significant threat.