Is CVE-2026-45694 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45694 being exploited in the wild.

How severe is CVE-2026-45694?

Medium severity, with a CVSS score of 5.4, published 26 August 2026.

Which products and versions are affected?

Librenms <= 26.4.0; librenms/librenms (Packagist) <= 26.4.0, ECOSYSTEM:introduced=0,fixed=26.5.0.

Is there a fix for CVE-2026-45694?

Yes. librenms/librenms (Packagist): upgrade to 26.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45694 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-45694?

Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45694: LibreNMS reflected XSS in Proxmox application component

Q: Which products and versions are affected?

Librenms <= 26.4.0; librenms/librenms (Packagist) <= 26.4.0, ECOSYSTEM:introduced=0,fixed=26.5.0.

Q: Is there a fix for CVE-2026-45694?

Yes. librenms/librenms (Packagist): upgrade to 26.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45694 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-45694?

Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45694 · Severity: medium · CVSS 5.4 · Published 2026-08-26

LibreNMS, a popular network monitoring tool, is vulnerable to a security flaw where malicious code can be injected into the application's page titles. An attacker could trick an authenticated user into clicking a specially crafted link, allowing the attacker to execute unauthorized scripts in the user's browser. This could lead to the theft of session cookies or other sensitive information handled within the monitoring dashboard.

Technologies: Librenms, librenms/librenms (Packagist). Vendors: Librenms, Packagist.

Quick answers

Is CVE-2026-45694 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45694 being exploited in the wild.
How severe is CVE-2026-45694?: Medium severity, with a CVSS score of 5.4, published 26 August 2026.
Which products and versions are affected?: Librenms <= 26.4.0; librenms/librenms (Packagist) <= 26.4.0, ECOSYSTEM:introduced=0,fixed=26.5.0.
Is there a fix for CVE-2026-45694?: Yes. librenms/librenms (Packagist): upgrade to 26.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45694 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-45694?: Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

librenms/librenms (Packagist): upgrade to 26.5.0 or later
```
composer require librenms/librenms:^26.5.0
```

Technical details

A reflected Cross-Site Scripting (XSS) vulnerability exists in LibreNMS within the Proxmox application integration. The root cause is located in `LegacyController.php`, which uses string interpolation to write the page title into a `document.title` JavaScript assignment without proper encoding. Specifically, the `instance` and `vmid` GET parameters in `apps/proxmox.inc.php` are only passed through `strip_tags()`, allowing an attacker to use a single quote to terminate the JS string and execute arbitrary code. Exploitation requires an authenticated session and user interaction (clicking a crafted link). The vulnerability is patched in version 26.5.0 by using `json_encode()` for the title assignment and `htmlspecialchars()` for the parameters.

Affected products

LibreNMS LibreNMS <= 26.4.0

Identifiers

CVE-2026-45694
GHSA-jmqm-f8q4-v7wx

Timeline

2026-08-04: disclosed: Initial disclosure to vendor
2026-08-12: advisory: GitHub Advisory published
2026-08-12: patched: Fixed in version 26.5.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.