{"id":"CVE-2026-11587","kind":"vulnerability","aliases":["CVE-2026-11587"],"related":[],"title":"Centreon: SQL injection lets an ACL manager read and change the database","description":"SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database","summary":"A logged-in user who can manage access control lists in Centreon can inject SQL into a request. That lets them read and modify the Centreon database.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"centreon-web","fixed":["25.10.15"],"affected":">= 25.10.0, < 25.10.15","ecosystem":"vendor"},{"name":"centreon-web","fixed":["24.10.28"],"affected":">= 24.10.0, < 24.10.28","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","centreon","runtime","self-hosted","sql-injection"],"not_affected_if":["auth-required","managed-hosting","no-acl-management-users"],"how_to_check":"On the Centreon central server run 'rpm -q centreon-web' (or 'dnf list installed centreon-web'; the version also shows in the web UI). Exposed if it is 25.10.x below 25.10.15 or 24.10.x below 24.10.28 and some account has access to ACL management (Resources or Actions access).","fix":"Update Centreon Web to 25.10.15 or later (25.10 branch), or 24.10.28 or later (24.10 branch). Later cumulative releases exist (25.10.17, 24.10.30 per the August 2026 bulletin).","status":"open","published_at":"2026-10-29T17:18:08+00:00","first_seen_at":"2026-10-29T17:26:17+00:00","triaged_at":"2026-10-29T17:27:56+00:00","updated_at":"2026-10-29T17:29:50+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-29T17:27:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Centreon: SQL injection lets an ACL manager read and change the database","impact":"high","summary":"A logged-in user who can manage access control lists in Centreon can inject SQL into a request. That lets them read and modify the Centreon database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["centreon","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads and modifies the Centreon database contents","analyst_note":"Find affected Centreon version ranges and the fixed release at https://nvd.nist.gov/vuln/detail/CVE-2026-11587 or the Centreon advisory.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-acl-management-users"],"who_is_affected":"Teams running Centreon monitoring, where users have been granted ACL management rights. Exposure depends on who holds those rights, and the sources do not name affected versions or configurations. Installations without users who can manage ACLs are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000618,"input_tokens":4051,"output_tokens":425,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected Centreon version ranges and the fixed release at https://nvd.nist.gov/vuln/detail/CVE-2026-11587 or the Centreon advisory.","search":"'-11587':15A,18A '-2026':14A,17A 'access':42B,69C 'acl':6A,71C 'allow':64C 'authent':25B,66C 'centreon':1A,20A,23A,26B,46B,60B,78C 'centreon-web':19A,22A 'chang':10A 'control':43B 'cve':13A,16A 'databas':12A,61B,79C 'host':30B 'inject':3A,33B,48B,63C 'let':4A,54B 'list':44B 'log':36B 'logged-in':35B 'manag':7A,41B,72C 'modifi':58B,76C 'read':8A,56B,74C 'request':52B 'runtim':27B 'self':29B 'self-host':28B 'sql':2A,32B,49B,62C 'sql-inject':31B 'user':38B,67C 'web':21A,24A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Centreon Web central servers on 25.10 before 25.10.15 or 24.10 before 24.10.28. The attacker must be logged in with rights to manage ACL (resources and actions) pages, which is a high privilege, and the flaw lets them read and change the whole Centreon database through a crafted request. Teams where only trusted admins have ACL management rights face lower risk.","tier":"B","verified":{"fix":{"at":"2026-10-29T17:29:50Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-11587","run_id":1085},"products":{"at":"2026-10-29T17:29:50Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-11587","run_id":1085},"who_affected":{"at":"2026-10-29T17:29:50Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-11587","run_id":1085}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T17:18:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-11587","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11587","severity":null,"published_at":"2026-10-29T17:18:08+00:00","modified_at":"2026-10-29T17:18:08+00:00","first_seen_at":"2026-10-29T17:26:17+00:00","fetched_at":"2026-10-29T17:26:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-11587:1085","url":null,"severity":null,"published_at":"2026-10-29T17:29:50+00:00","modified_at":"2026-10-29T17:29:50+00:00","first_seen_at":"2026-10-29T17:29:50+00:00","fetched_at":"2026-10-29T17:29:50+00:00","note":"Read Centreon's own CNA CVE record (cveawg): CVSS 7.2 (PR:H), CWE-89, finder Vincent UNTZ. Affected 25.10 before 25.10.15 and 24.10 before 24.10.28. Vendor advisory link in the record is broken ('undefined'), so no thewatch bulletin read for this CVE. No exploitation or PoC found. How-to-check is my own inference, not verified. Record title says 26.03.0, unclear; 26.03 range not stated."}],"documents":[{"id":18243,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-11587","title":"CVE-2026-11587 CVE record (CNA: Centreon)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":18244,"url":"https://thewatch.centreon.com/latest-security-bulletins-64/july-2026-monthly-security-bulletin-for-centreon-infra-monitoring-5865","title":"July 2026 Centreon security bulletin (context, fixes 25.10.16 / 24.10.29)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}