Is CVE-2026-6204 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6204 being exploited in the wild.

How severe is CVE-2026-6204?

High severity, with a CVSS score of 7.2, published 13 April 2026.

Which products and versions are affected?

Librenms >= 1.48, = 1.48, < 26.3.0, ECOSYSTEM:introduced=1.48,fixed=26.3.0.

Is there a fix for CVE-2026-6204?

Yes. librenms/librenms (Packagist): upgrade to 26.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6204 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-6204?

Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6204: LibreNMS remote code execution in Binary Locations config

Q: Is there a fix for CVE-2026-6204?

Yes. librenms/librenms (Packagist): upgrade to 26.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-6204 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-6204?

Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6204 · Severity: high · CVSS 7.2 · Published 2026-04-13

LibreNMS, a popular network monitoring system, contains a vulnerability that allows an administrator to execute arbitrary commands on the underlying server. By manipulating the configuration for network diagnostic tools, a malicious user with administrative access can download and run unauthorized scripts. This could lead to a full system takeover, data theft, or further attacks on the internal network.

Technologies: Librenms, librenms/librenms (Packagist). Vendors: Librenms, Packagist.

Quick answers

Is CVE-2026-6204 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6204 being exploited in the wild.
How severe is CVE-2026-6204?: High severity, with a CVSS score of 7.2, published 13 April 2026.
Which products and versions are affected?: Librenms >= 1.48, < 26.3.0; librenms/librenms (Packagist) >= 1.48, < 26.3.0, ECOSYSTEM:introduced=1.48,fixed=26.3.0.
Is there a fix for CVE-2026-6204?: Yes. librenms/librenms (Packagist): upgrade to 26.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6204 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-6204?: Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

librenms/librenms (Packagist): upgrade to 26.3.0 or later
```
composer require librenms/librenms:^26.3.0
```

Technical details

An OS command injection vulnerability exists in LibreNMS due to insufficient validation of binary paths for network diagnostic tools. Authenticated administrators can modify absolute binary paths at '/settings/external/binaries' to point to arbitrary system executables like 'wget' or 'bash'. By bypassing an input filter on the 'GET /ajax/netcmd' endpoint, an attacker can first download a malicious script and subsequently execute it. This allows for full remote code execution (RCE) on the host server. The issue is addressed in version 26.3.0 by restricting binary path configurations.

Affected products

LibreNMS LibreNMS >= 1.48, < 26.3.0

Identifiers

CVE-2026-6204
GHSA-pr3g-phhr-h8fh

Timeline

2026-03-24: disclosed
2026-03-26: advisory
2026-03-26: patched: Version 26.3.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.