# CVE-2026-2728: LibreNMS authenticated XSS in showconfig page

Source: https://junglewise.ai/threats/cve-2026-2728-librenms-authenticated-xss-in-showconfig-page  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-13. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-2728 · Severity: medium · CVSS 4.8 · Published 2026-04-13

LibreNMS is an open-source network monitoring system used to manage and track the health of IT infrastructure. A security vulnerability in its configuration interface allows an administrator to inject malicious scripts into the system's settings. In environments with multiple administrators, a compromised or malicious staff member could use this to hijack the sessions of other IT managers or steal sensitive operational data when they view device configuration pages.

Technologies: [Librenms](https://junglewise.ai/threats/technologies/librenms), [librenms/librenms (Packagist)](https://junglewise.ai/threats/technologies/librenms-librenms). Vendors: [Librenms](https://junglewise.ai/threats/vendors/librenms), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-2728 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2728 being exploited in the wild.

**How severe is CVE-2026-2728?** Medium severity, with a CVSS score of 4.8, published 13 April 2026.

**Which products and versions are affected?** Librenms >= 25.12.0, < 26.3.0; librenms/librenms (Packagist) < 26.3.0, >= 25.12.0, < 26.3.0, ECOSYSTEM:introduced=25.12.0,fixed=26.3.0.

**Is there a fix for CVE-2026-2728?** Yes. librenms/librenms (Packagist): upgrade to 26.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2728 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-2728?** Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- librenms/librenms (Packagist): upgrade to 26.3.0 or later

  ```sh
  composer require librenms/librenms:^26.3.0
  ```


## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS within the ShowConfig page for devices utilizing RANCID integration. The root cause is a failure to sanitize the 'rancid_repo_url' configuration value before rendering it within an HTML anchor tag in 'includes/html/pages/device/showconfig.inc.php'. An authenticated attacker with permissions to modify external settings can inject a payload into the 'rancid_repo_url' field. When another user navigates to the affected device's configuration page, the unsanitized input is executed as JavaScript in their browser context. This is classified as an Admin-to-Admin XSS. The issue is fixed in version 26.3.0.

## Affected products

- LibreNMS LibreNMS >= 25.12.0, < 26.3.0

## Identifiers

- CVE-2026-2728
- GHSA-5gm9-622f-qcg5
- GHSA-rp7w-624x-95qv

## Timeline

- 2026-05-12: patched: Version 26.3.0 released
- 2026-05-18: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/YuriNek0](https://api.github.com/users/YuriNek0)
- [https://github.com/YuriNek0](https://github.com/YuriNek0)
- [https://api.github.com/users/YuriNek0/gists%7B/gist_id%7D](https://api.github.com/users/YuriNek0/gists%7B/gist_id%7D)
- [https://api.github.com/users/YuriNek0/repos](https://api.github.com/users/YuriNek0/repos)
- [https://avatars.githubusercontent.com/u/23434411?v=4](https://avatars.githubusercontent.com/u/23434411?v=4)
- [https://api.github.com/users/YuriNek0/events%7B/privacy%7D](https://api.github.com/users/YuriNek0/events%7B/privacy%7D)

## Related threats

- [LibreNMS LDAP filter injection in external authorization modes](https://junglewise.ai/threats/cve-2026-109357-librenms-before-26-9-0-contains-an-ldap-filter-injection-in-ldap)
- [LibreNMS missing authorization in PortsController::purge](https://junglewise.ai/threats/cve-2026-109356-librenms-before-26-9-0-contains-a-missing-authorization)
- [LibreNMS stored cross-site scripting in Oxidized node list](https://junglewise.ai/threats/cve-2026-109355-librenms-before-26-9-0-contains-a-stored-cross-site-scripting)
- [LibreNMS path traversal in NFSen channel parameter](https://junglewise.ai/threats/cve-2026-109354-librenms-before-26-9-0-contains-a-path-traversal-vulnerability)
- [LibreNMS SQL injection in notifications.inc.php](https://junglewise.ai/threats/cve-2026-109353-librenms-before-26-9-0-contains-an-sql-injection-vulnerability)