---
id: "CVE-2026-11587"
kind: "vulnerability"
aliases: ["CVE-2026-11587"]
title: "Centreon: SQL injection lets an ACL manager read and change the database"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "centreon-web", "fixed": ["25.10.15"], "affected": ">= 25.10.0, < 25.10.15", "ecosystem": "vendor"}, {"name": "centreon-web", "fixed": ["24.10.28"], "affected": ">= 24.10.0, < 24.10.28", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "centreon", "runtime", "self-hosted", "sql-injection"]
not_affected_if: ["auth-required", "managed-hosting", "no-acl-management-users"]
published_at: "2026-10-29T17:18:08+00:00"
first_seen_at: "2026-10-29T17:26:17+00:00"
updated_at: "2026-10-29T17:29:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11587", "first_seen_at": "2026-10-29T17:26:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T17:29:50+00:00"}]
---

# Centreon: SQL injection lets an ACL manager read and change the database

A logged-in user who can manage access control lists in Centreon can inject SQL into a request. That lets them read and modify the Centreon database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:centreon-web affected >= 25.10.0, < 25.10.15 fixed 25.10.15
- vendor:centreon-web affected >= 24.10.0, < 24.10.28 fixed 24.10.28

## How to check

On the Centreon central server run 'rpm -q centreon-web' (or 'dnf list installed centreon-web'; the version also shows in the web UI). Exposed if it is 25.10.x below 25.10.15 or 24.10.x below 24.10.28 and some account has access to ACL management (Resources or Actions access).

## Fix

Update Centreon Web to 25.10.15 or later (25.10 branch), or 24.10.28 or later (24.10 branch). Later cumulative releases exist (25.10.17, 24.10.30 per the August 2026 bulletin).

## Timeline

- 2026-10-29T17:26:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-11587
- 2026-10-29T17:29:50+00:00 analyst — Read Centreon's own CNA CVE record (cveawg): CVSS 7.2 (PR:H), CWE-89, finder Vincent UNTZ. Affected 25.10 before 25.10.15 and 24.10 before 24.10.28. Vendor advisory link in the record is broken ('undefined'), so no thewatch bulletin read for this CVE. No exploitation or PoC found. How-to-check is my own inference, not verified. Record title says 26.03.0, unclear; 26.03 range not stated.

## Documents

- [advisory] CVE-2026-11587 CVE record (CNA: Centreon) https://cveawg.mitre.org/api/cve/CVE-2026-11587
- [mentions] July 2026 Centreon security bulletin (context, fixes 25.10.16 / 24.10.29) https://thewatch.centreon.com/latest-security-bulletins-64/july-2026-monthly-security-bulletin-for-centreon-infra-monitoring-5865

## From the sources

SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_