{"id":"CVE-2026-86427","title":"LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtool arguments by breaking out of double-quote escaping","summary":"LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtool arguments by breaking out of double-quote escaping. Attackers can inject DEF…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-77"],"vendor":"librenms","product":"librenms","affected":["librenms < 26.8.0"],"patched":["librenms 26.8.0"],"published":"2026-09-07","updated":"2026-09-18","sourceUpdated":"2026-09-18T18:33:07.897","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86427","references":[{"url":"https://github.com/librenms/librenms/security/advisories/GHSA-3hvv-wxpw-cx83","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/librenms-before-26.8.0-argument-injection-via-graph-title","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"epss":0.00605,"epssPercentile":0.46627,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T14:24:54.486459Z"},"ingestedAt":"2026-09-08T20:10:03.179Z","slug":"CVE-2026-86427","body":"## Overview\n\nLibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtool arguments by breaking out of double-quote escaping. Attackers can inject DEF and LINE arguments to read RRD files from unauthorized devices, or use newline injection to execute arbitrary rrdtool commands, bypassing per-device authorization checks.\n\n## Affected\n\n- `librenms < 26.8.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `librenms 26.8.0`","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}