Identity and accessCritical severity

SECURITY GUIDE

LDAP Filter Injection in LibreNMS (CVE-2026-109357)

Understand how unescaped user input in directory search queries permits authentication bypass and directory attribute enumeration.

Areas to considerLibreNMS network monitoringLDAP / Active Directory authenticationEnterprise monitoring consoles
01

THE CONTEXT

What to understand

CVE-2026-109357 is an LDAP filter injection vulnerability in LibreNMS versions prior to 26.9.0. During user authentication against LDAP or Active Directory backends, the username string was concatenated directly into search filter strings without proper character escaping. By submitting usernames containing LDAP boolean operators and wildcard characters, an attacker can alter the query logic, bypass password checks, or enumerate directory attributes.

02

HIGH-LEVEL CONCEPT

How the risk can develop

This is a conceptual overview, not a procedure for reproducing an attack.

  1. An unauthenticated attacker submits a login request with a crafted username containing LDAP filter syntax (e.g. wildcards and boolean operators).
  2. The authentication backend constructs an LDAP query string through simple string concatenation without escaping special characters.
  3. The directory service processes the modified logic, causing the search query to match an existing administrative account regardless of password.
  4. The application accepts the successful directory match and grants an active authenticated administrative session.
03

WHY IT MATTERS

Potential impact

Bypass of login authentication to gain administrative access to network monitoring consoles, exposure of directory contents, and network device configuration tampering.

04

BE AWARE

Signals to monitor

  • LDAP / Active Directory server access logs showing queries with unbalanced parentheses, asterisks, or pipe characters in sAMAccountName filters.
  • Authentication logs in LibreNMS showing logins with unusual non-alphanumeric username strings.
  • Multiple rapid login attempts with varied LDAP query syntax against network management portals.
05

PUT DEFENSE FIRST

Recommended defenses

  1. 01Upgrade LibreNMS to version 26.9.0 or later where proper LDAP filter escaping functions (ldap_escape) are enforced.
  2. 02Sanitize and validate login usernames against strict alphanumeric allowlists before passing them to directory authentication routines.
  3. 03Restrict directory service bind accounts to read-only access with minimum necessary attribute visibility.
  4. 04Deploy multi-factor authentication (MFA) in front of network monitoring web consoles.