CVE-2026-26989
📋 TL;DR
This is a stored cross-site scripting (XSS) vulnerability in LibreNMS that allows attackers with administrative privileges to inject malicious scripts into the Alert Rules workflow. When other users view the Alert Rules page, these scripts execute in their browser context. Only LibreNMS instances running versions 25.12.0 or below are affected.
💻 Affected Systems
- LibreNMS
📦 What is this software?
Librenms by Librenms
⚠️ Risk & Real-World Impact
Worst Case
An attacker with admin access could steal session cookies, perform actions as other users, redirect to malicious sites, or install malware on user systems.
Likely Case
Privilege escalation within the LibreNMS application, session hijacking, or credential theft from authenticated users.
If Mitigated
Limited impact due to requiring administrative privileges for exploitation and affecting only users who access the Alert Rules page.
🎯 Exploit Status
Exploitation requires administrative access to LibreNMS. The vulnerability is in the Alert Rules workflow where input validation is insufficient.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 26.2.0
Vendor Advisory: https://github.com/librenms/librenms/security/advisories/GHSA-6xmx-xr9p-58p7
Restart Required: No
Instructions:
1. Backup your LibreNMS installation and database. 2. Update LibreNMS to version 26.2.0 or later using your preferred update method. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Restrict Administrative Access
allLimit administrative privileges to only trusted users who absolutely need them.
Content Security Policy
allImplement a strict Content Security Policy header to mitigate XSS impact.
🧯 If You Can't Patch
- Remove administrative privileges from untrusted users
- Implement web application firewall rules to block XSS payloads
🔍 How to Verify
Check if Vulnerable:
Check LibreNMS version via web interface or by examining the installation directory. Versions 25.12.0 or below are vulnerable.Check Version:
php /opt/librenms/includes/common.php -vVerify Fix Applied:
Confirm LibreNMS version is 26.2.0 or later. Test Alert Rules functionality to ensure proper input sanitization.📡 Detection & Monitoring
Log Indicators:
- Unusual modifications to Alert Rules by administrative users
- Suspicious JavaScript payloads in application logs
Network Indicators:
- Unexpected outbound connections from LibreNMS server when users access Alert Rules
SIEM Query:
source="librenms" AND (alert_rules OR "XSS" OR "script")