MEDIUM 5.3 NVD
CVE-2026-108715
LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead
LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokeping_in or smokeping_out graphs with arbitrary device ids to view latency data and enumerate device names.
References
- https://github.com/librenms/librenms
- https://github.com/librenms/librenms/blob/26.9.1.1/LibreNMS/Util/Graph.php#L190-L198
- https://github.com/librenms/librenms/blob/26.9.1.1/includes/html/graphs/smokeping/auth.inc
- https://hackmd.io/@haind/librenms-smokeping-graph-src-device-auth-confusion
- https://www.vulncheck.com/advisories/librenms-through-26.9.1.1-authorization-bypass-via-sm
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-11 via NVD.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.