Read the docs
TI-2026-58894 Aliases CVE-2026-86091GHSA-x89w-3wg2-6mvv

ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler

Priority MEDIUM 64CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00517 44th percentileScored 2026-11-07
Fix Fixed ntopng (ntop): 6.7.260717

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ntopntopngbefore 6.7.2607176.7.260717Patch availableCNA
  • ntopng Vendorntop Affected before 6.7.260717 Fixed in 6.7.260717 Patch available CNA

Remediation

  • Fix · CNA ntopng (ntop) Fixed in 6.7.260717

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    ntop ntopng — GitHub Security Advisory (GHSA-m22w-f647-vx88)

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-58893 ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete HandlersPriority LOW 32
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-86091
  2. 2026-10-03 Alias added: GHSA-x89w-3wg2-6mvv

References

Patch 1

Advisory 1

Other 3

  • TI-2026-58397 ntopng: Missing Authorization on System Configuration Backup Download and Listing CVSS 3.1HIGH 8.8
  • TI-2026-58396 ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags CVSS 3.1HIGH 7.1
  • TI-2026-85500 Stack buffer overflow in ntopng nDPI custom category detection CVSS 3.1MEDIUM 5.3
  • TI-2026-28235 ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to… CVSS 3.1CRITICAL 9.8
  • TI-2020-09603 In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer… CVSS 3.1CRITICAL 9.8
  • TI-2018-08982 An issue was discovered in ntopng 3.4 before 3.4.180617. CVSS 3.1HIGH 8.1
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences