Is CVE-2026-2728 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-2728 being exploited in the wild.

How severe is CVE-2026-2728?

Medium severity, with a CVSS score of 4.8, published 13 April 2026.

Which products and versions are affected?

Librenms >= 25.12.0, = 25.12.0, < 26.3.0, ECOSYSTEM:introduced=25.12.0,fixed=26.3.0.

Is there a fix for CVE-2026-2728?

Yes. librenms/librenms (Packagist): upgrade to 26.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-2728 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-2728?

Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2728: LibreNMS authenticated XSS in showconfig page

Q: Is there a fix for CVE-2026-2728?

Yes. librenms/librenms (Packagist): upgrade to 26.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-2728 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-2728?

Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2728 · Severity: medium · CVSS 4.8 · Published 2026-04-13

LibreNMS is an open-source network monitoring system used to manage and track the health of IT infrastructure. A security vulnerability in its configuration interface allows an administrator to inject malicious scripts into the system's settings. In environments with multiple administrators, a compromised or malicious staff member could use this to hijack the sessions of other IT managers or steal sensitive operational data when they view device configuration pages.

Technologies: Librenms, librenms/librenms (Packagist). Vendors: Librenms, Packagist.

Quick answers

Is CVE-2026-2728 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-2728 being exploited in the wild.
How severe is CVE-2026-2728?: Medium severity, with a CVSS score of 4.8, published 13 April 2026.
Which products and versions are affected?: Librenms >= 25.12.0, < 26.3.0; librenms/librenms (Packagist) < 26.3.0, >= 25.12.0, < 26.3.0, ECOSYSTEM:introduced=25.12.0,fixed=26.3.0.
Is there a fix for CVE-2026-2728?: Yes. librenms/librenms (Packagist): upgrade to 26.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2728 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-2728?: Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

librenms/librenms (Packagist): upgrade to 26.3.0 or later
```
composer require librenms/librenms:^26.3.0
```

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS within the ShowConfig page for devices utilizing RANCID integration. The root cause is a failure to sanitize the 'rancid_repo_url' configuration value before rendering it within an HTML anchor tag in 'includes/html/pages/device/showconfig.inc.php'. An authenticated attacker with permissions to modify external settings can inject a payload into the 'rancid_repo_url' field. When another user navigates to the affected device's configuration page, the unsanitized input is executed as JavaScript in their browser context. This is classified as an Admin-to-Admin XSS. The issue is fixed in version 26.3.0.

Affected products

LibreNMS LibreNMS >= 25.12.0, < 26.3.0

Identifiers

CVE-2026-2728
GHSA-5gm9-622f-qcg5
GHSA-rp7w-624x-95qv

Timeline

2026-05-12: patched: Version 26.3.0 released
2026-05-18: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.