Is CVE-2026-55182 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55182 being exploited in the wild.

How severe is CVE-2026-55182?

High severity, with a CVSS score of 4, published 26 August 2026.

Which products and versions are affected?

Librenms >=21.6.0, = 21.6.0, < 26.5.0, ECOSYSTEM:introduced=21.6.0,fixed=26.5.0.

Is there a fix for CVE-2026-55182?

Yes. librenms/librenms (Packagist): upgrade to 26.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55182 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55182?

Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55182: LibreNMS remote code execution in Signal alert transport

Q: Is there a fix for CVE-2026-55182?

Yes. librenms/librenms (Packagist): upgrade to 26.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55182 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-55182?

Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55182 · Severity: high · CVSS 4 · Published 2026-08-26

LibreNMS is a network monitoring and management platform used by organizations to track infrastructure health and send alerts. An authenticated administrator can inject malicious commands into alert transport configuration fields, leading to arbitrary code execution on the server. This allows an insider threat to compromise the entire monitoring infrastructure, access sensitive network data, or establish a foothold for further attacks.

Technologies: Librenms, librenms/librenms (Packagist). Vendors: Librenms, Packagist.

Quick answers

Is CVE-2026-55182 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55182 being exploited in the wild.
How severe is CVE-2026-55182?: High severity, with a CVSS score of 4, published 26 August 2026.
Which products and versions are affected?: Librenms >=21.6.0, <26.5.0; librenms/librenms (Packagist) >= 21.6.0, < 26.5.0, ECOSYSTEM:introduced=21.6.0,fixed=26.5.0.
Is there a fix for CVE-2026-55182?: Yes. librenms/librenms (Packagist): upgrade to 26.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55182 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55182?: Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

librenms/librenms (Packagist): upgrade to 26.5.0 or later
```
composer require librenms/librenms:^26.5.0
```

Technical details

The vulnerability is a command injection flaw in the Signal alert transport module (LibreNMS/Alert/Transport/Signal.php) and the composer_wrapper.php script. The deliverAlert function constructs shell commands using unsafe exec() calls with insufficient escaping of user-supplied inputs, specifically the executable path and recipient fields. An authenticated administrator can chain these two vulnerable exec() calls by setting the path to ../scripts/composer_wrapper.php and injecting shell metacharacters (`;` delimiters) in the Recipient field to execute arbitrary commands. The vulnerability affects versions 21.6.0 through 26.4.x and is fixed in version 26.5.0. Authentication as an administrator is required to exploit this issue.

Affected products

LibreNMS LibreNMS >=21.6.0, <26.5.0

Identifiers

CVE-2026-55182
GHSA-c9fv-cgmm-2wg7

Timeline

2026-08-18: disclosed: Advisory published
2026-06-10: patched: Fix released in version 26.5.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.