LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped… (CVE-2026-109357)

The vulnerability in LibreNMS before version 26.9.0 is an LDAP filter injection affecting ldap-authorization and ad-authorization modes. Usernames are inserted unescaped into LDAP search filters, allowing injection. Authentication only checks if a user exists, not the validity of the username input. When REMOTE_USER is not forwarded, attackers can supply a wildcard username through HTTP Basic Authorization (PHP_AUTH_USER), causing the LDAP filter to match all users and groups. This can lead to unauthorized administrative access.

An unauthenticated attacker can exploit this vulnerability to gain administrative access to the LibreNMS system by bypassing authentication controls. This compromises confidentiality, integrity, and availability of the system, as indicated by the CVSS score of 8.1 with high impact on all three security properties.

A fix is available in LibreNMS version 26.9.0. Users should upgrade to version 26.9.0 or later to remediate this vulnerability. Until then, avoid configurations where REMOTE_USER is not forwarded or restrict access to trusted users only. Patch status is not explicitly confirmed in the provided data, so verify the vendor advisory for current remediation guidance.