CVE-2026-84990Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and scripts/lua/rest/v2/get/system/configurations/download_backup.lua allow any authenticated non-admin user to list and download system-configuration backups without an administrator check. The download path reaches backup_config.export_backup, and prefs_dump_utils.build_prefs_dump_table includes the ntopng.user.* Redis key space in the backup. A downloaded backup can therefore disclose password hashes for local users and, when configured, API tokens, TOTP secrets, and WebAuthn credential data, enabling account compromise through usable or recoverable credentials. This issue is fixed in version 6.7.260718.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-200CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-09-22); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

Patch

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-22	1	Disclosure1
2026-10-15	1	Patch1

Full discourse2 posts

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters23d
Patch
CVE-2026-84990 ntopng: any authenticated non-admin can list and download full system config backups, exposing ntopng.user.* Redis keys. CVSS 8.8. Patch still under review, restrict access now. https://www.valtersit.com/cve/CVE-2026-84990 #CVE #infosec #cybersecurity #ntopng #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The text discloses CVE-2026-84990 in ntopng (CVSS 8.8) where authenticated non-admin users can exfiltrate system config backups exposing Redis credentials, and recommends restricting access as an immediate workaround while a patch is under review.
0002046
1.1K followersView on X
NewNormal Security@NewScanTeam46d
Disclosure
NewNormal Security turns CVEs since the previous batch into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 22 Sep 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: ✂️ Edge proxy path confusion and upgrade tunnelling — smuggle a request past the proxy's own access control (Envoy CVE-2026-73548, CVE-2026-73552, CVE-2026-73553, CVE-2026-73511, CVE-2026-73551) 🖥️ Service mesh proxy admin console reachable with no password — dump upstreams, listeners and the TLS material they reference (Envoy CVE-2026-73546) 📦 Network monitoring appliance on an unpatched build — read its stored config backups, or run commands on the box that sees every flow (ntop ntopng CVE-2026-84990, CVE-2026-82412) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #RequestSmuggling #CSO #REDTEAM
Post summary
NewNormal Security shares a daily CVE report detailing technical impacts for multiple Envoy and ntopng vulnerabilities to promote their detection tool, without linking exploits, patches, or active exploitation.
0000047
6 followersView on X

Explore more

Back to dashboard