CVE-2026-86091 in ntopng
Summary
by MITRE • 09/04/2026
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in ntopng versions prior to 6.7.260717 represents a critical failure in access control mechanisms within the application's web interface. Specifically, the flaw resides in the bulk-delete endpoint responsible for managing host pools and their associated member bindings. In a properly secured system, operations that modify global configuration or delete significant data structures should be restricted to users with administrative privileges. However, this implementation fails to verify whether the authenticated user possesses the necessary permissions before executing the deletion request. This oversight allows any validly authenticated account, regardless of its role or privilege level, to interact with sensitive management functions intended exclusively for system administrators.
From a technical perspective, an attacker can exploit this flaw by crafting and sending HTTP POST requests directly to the delete pools endpoint. Because the server does not validate the user's authorization context against the requested action, it processes the deletion commands as if they originated from an administrator account. This lack of proper object-level access control means that non-administrative users can irreversibly destroy every host pool configured in the system. Host pools are fundamental to ntopng's functionality, serving as containers for network hosts and defining how traffic is monitored and categorized. The destruction of these pools effectively dismantles the structural integrity of the monitoring environment.
The operational impact of this vulnerability extends beyond simple data loss. By deleting all host pools, an attacker also removes associated traffic policy bindings and visibility restrictions. These policies often dictate which networks are visible to specific users or how network traffic is segmented for security analysis. Their removal can lead to a complete breakdown in the organization's network monitoring capabilities. Furthermore, if these visibility restrictions were part of a broader security architecture designed to limit lateral movement or isolate sensitive segments, their deletion could allow attackers to bypass existing security policies. This creates an environment where malicious activities might go undetected for extended periods due to the loss of granular oversight and control mechanisms.
This vulnerability aligns with CWE-269, which describes Improper Privilege Control, as it involves a failure to enforce required privileges before performing sensitive operations. It also relates to CWE-862, Missing Authorization, since the application fails to ensure that only authorized users can perform specific actions on protected resources. In terms of the MITRE ATT&CK framework, this behavior is consistent with techniques found under Tactic TA0005 (Defense Evasion), specifically where an attacker might manipulate system configurations to avoid detection or disrupt security controls. The ability to delete monitoring infrastructure effectively blinds defenders to ongoing network activities, facilitating further malicious actions without immediate alerting from the compromised ntopng instance.
Mitigation for this issue requires upgrading to version 6.7.260717 or later of ntopng, where the access control logic has been corrected to properly validate user privileges before processing bulk deletion requests. Until an upgrade is feasible, organizations should implement network-level controls such as firewall rules or web application firewalls that restrict access to the affected API endpoints exclusively from trusted administrative IP addresses. Additionally, enforcing strict role-based access control policies and ensuring that no non-administrative accounts have write permissions on configuration-related interfaces can reduce the attack surface. Regular auditing of user privileges and monitoring for unusual HTTP POST requests targeting management endpoints are also recommended defensive measures to detect potential exploitation attempts early.