API token type-confusion bypasses LibreNMS REST API authentication, exposing SNMP credentials and enabling RCE (CVE-2026-86426)
VulnCheck's canary sensors recorded exploitation attempts against this bypass on 2026-10-28 and it was added to VulnCheck KEV the same day, so LibreNMS instances below 26.8.0 with any API token are at risk of credential theft and server takeover from unauthenticated requests.
LibreNMS compares the API token against the token_hash column, and sending a small integer (0–9) instead of a string makes MySQL coerce the column to a number so the attacker matches a real token without knowing it. The attacker inherits that token owner's access to the whole /api/v0 REST API, including stored SNMP credentials for every device, and an admin token allows remote code execution through Blade @php blocks in alert templates. At least one enabled API token must exist on the target.
Affected: LibreNMS <= 26.7.0 (all versions before 26.8.0)
How to Test
Check the running version (LibreNMS/Util/Version.php or the About page); anything below 26.8.0 is affected if any API token exists. Review web server logs for requests to /api/v0/* (especially GET /api/v0/devices) sent with no X-Auth-Token header and a JSON body whose api_token is a bare number such as 0–9 or an array such as [0], inspect alert templates for unexpected @php blocks, and treat SNMP community strings, authpass and privpass values stored in LibreNMS as exposed if such requests are found.
How to Patch
Upgrade LibreNMS to 26.8.0 or later per https://github.com/librenms/librenms/security/advisories/GHSA-cvq8-gqfq-3mvg. If the upgrade must wait, disable or delete all API tokens (the bypass needs an existing enabled token to match) and restrict network access to /api/v0; rotate any SNMP credentials that may have been read.