Read the docs
TI-2026-57889 Aliases CVE-2026-84193GHSA-43px-cc38-6vvc

LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP

Priority MEDIUM 59CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Passive
Attack complexity
High
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enroll a rogue SNMP device can inject malicious JavaScript that executes when admins view affected routing and device pages, enabling credential theft and CSRF token exfiltration.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00349 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
librenmslibrenmsup to 26.2.0—No fix listedCNA
  • librenms Vendorlibrenms Affected up to 26.2.0 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*——librenms
  • cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:* Versions — — ·librenms

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-84193
  2. 2026-10-03 Alias added: GHSA-43px-cc38-6vvc

References

Advisory 1

  • TI-2018-14479 LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the… CVSS 3.0CRITICAL 9.8
  • TI-2026-71173 LDAP filter injection in LibreNMS allows authentication bypass CVSS 4.0CRITICAL 9.2
  • TI-2026-59134 LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion CVSS 4.0CRITICAL 9.2
  • TI-2026-57885 LibreNMS before 26.7.0 Stored XSS via Oxidized API CVSS 4.0CRITICAL 9.2
  • TI-2022-03735 Insufficient Session Expiration in librenms/librenms CVSS 3.1CRITICAL 9.8
  • TI-2026-57886 LibreNMS before 26.5.0 Remote Code Execution via AboutController CVSS 4.0HIGH 8.7
See all 123 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences