Description
LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtool arguments by breaking out of double-quote escaping. Attackers can inject DEF and LINE arguments to read RRD files from unauthorized devices, or use newline injection to execute arbitrary rrdtool commands, bypassing per-device authorization checks.
Published: 2026-09-07
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Potential command execution via rrdtool injection
Action: Patch
AI Analysis

Impact

The vulnerability is an argument injection flaw in the graph_title parameter of LibreNMS. The bug allows an authenticated user to inject arbitrary rrdtool arguments by breaking out of double-quote escaping. Attackers can provide DEF and LINE arguments to read RRD files from devices they are not authorized to see, or inject newline characters to execute arbitrary rrdtool commands. This bypasses per-device authorization checks and corresponds to CWE‑77.

Affected Systems

The issue affects the LibreNMS network monitoring platform, with all versions older than 26.8.0 being vulnerable. The CNA identifies the affected product as librenms:librenms. Any installation running a pre‑26.8.0 version is susceptible.

Risk and Exploitability

The flaw carries a CVSS score of 8.7, indicating high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session to the LibreNMS web interface; an account holder can craft a malicious graph_title value that injects the unwanted rrdtool arguments. Once authenticated, the attacker can read unauthorized RRD files or execute arbitrary commands via rrdtool, which may lead to information disclosure or remote command execution.

Generated by OpenCVE AI on September 7, 2026 at 15:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to LibreNMS 26.8.0 or later to remove the injection flaw.
  • If upgrading is delayed, disable the graph_title query parameter or enforce a strict whitelist that permits only safe characters in the title.
  • Add input validation to the graph_title field by stripping or escaping quotes and newlines, preventing malicious argument injection.

Generated by OpenCVE AI on September 7, 2026 at 15:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 10 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 07 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
Description LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtool arguments by breaking out of double-quote escaping. Attackers can inject DEF and LINE arguments to read RRD files from unauthorized devices, or use newline injection to execute arbitrary rrdtool commands, bypassing per-device authorization checks.
Title LibreNMS before 26.8.0 Argument Injection via graph_title
First Time appeared Librenms
Librenms librenms
Weaknesses CWE-77
CPEs cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*
Vendors & Products Librenms
Librenms librenms
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Librenms Librenms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-10T15:04:16.545Z

Reserved: 2026-09-07T12:33:13.368Z

Link: CVE-2026-86427

cve-icon Vulnrichment

Updated: 2026-09-10T14:24:55.735Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-07T13:20:41.870

Modified: 2026-09-18T18:33:07.897

Link: CVE-2026-86427

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T16:00:13Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')