CVE-2026-26991
📋 TL;DR
This stored XSS vulnerability in LibreNMS allows attackers with admin privileges to inject malicious scripts into device group names, which execute when other users view those groups. It affects LibreNMS versions 26.1.1 and below. The vulnerability requires admin-level access but can impact all users who view the compromised device groups.
💻 Affected Systems
- LibreNMS
📦 What is this software?
Librenms by Librenms
⚠️ Risk & Real-World Impact
Worst Case
Admin attacker could steal session cookies, redirect users to malicious sites, perform actions as authenticated users, or deploy malware to administrators' browsers.
Likely Case
Attackers with compromised admin accounts could steal credentials from other users, modify monitoring data, or disrupt network monitoring operations.
If Mitigated
With proper input validation and output encoding, the script payloads would be rendered harmless as text rather than executed.
🎯 Exploit Status
Exploitation requires admin privileges but is trivial once those credentials are obtained. The vulnerability is in a core feature with clear attack vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 26.2.0
Vendor Advisory: https://github.com/librenms/librenms/security/advisories/GHSA-5pqf-54qp-32wx
Restart Required: No
Instructions:
1. Backup your LibreNMS installation and database. 2. Update to version 26.2.0 or later using your preferred update method (git pull, package manager, or manual download). 3. Run ./daily.sh to update the database schema if needed. 4. Verify the fix by checking that device group names are properly sanitized.
🔧 Temporary Workarounds
Input Validation via Web Application Firewall
allConfigure WAF rules to block XSS payloads in POST requests to /device-groups endpoint
Restrict Admin Privileges
allReview and minimize admin accounts, implement strong authentication for admin users
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Monitor and audit all device group creation/modification activities for suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check if your LibreNMS version is 26.1.1 or earlier. Attempt to create a device group with a name containing <script>alert('test')</script> - if the script executes when viewing, you're vulnerable.Check Version:
cd /opt/librenms && php includes/functions.php versionVerify Fix Applied:
After updating to 26.2.0+, attempt the same XSS test - the script should appear as plain text rather than executing.📡 Detection & Monitoring
Log Indicators:
- POST requests to /device-groups containing script tags or JavaScript in name parameter
- Unusual device group creation patterns from admin accounts
Network Indicators:
- HTTP traffic to /device-groups with suspicious payloads in POST data
SIEM Query:
source="librenms.log" AND "POST /device-groups" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=")