CVE-2026-26990: LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php

February 18, 2026

A time-based blind SQL injection vulnerability exists in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses.

References

github.com/advisories/GHSA-79q9-wc6p-cf92
github.com/librenms/librenms
github.com/librenms/librenms/commit/15429580baba03ed1dd377bada1bde4b7a1175a1
github.com/librenms/librenms/pull/18777
github.com/librenms/librenms/security/advisories/GHSA-79q9-wc6p-cf92
nvd.nist.gov/vuln/detail/CVE-2026-26990

Code Behaviors & Features

Detect and mitigate CVE-2026-26990 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →