Executive brief
LibreNMS is an open-source network monitoring platform used by organizations to track infrastructure and device health. An authenticated administrator can inject arbitrary shell commands into virtualization discovery settings, leading to remote code execution on the monitoring server. An attacker with admin access can compromise the entire monitoring infrastructure and potentially pivot to other systems on the network.
Technical details
The vulnerability is a command-line injection flaw in LibreNMS/OS/Traits/VminfoLibvirt.php where user input from the web UI (Libvirt Username and Libvirt Protocols fields) is concatenated directly into exec() calls without sanitization. An authenticated administrator can inject shell metacharacters (e.g., semicolons) to execute arbitrary commands that run with the privileges of the LibreNMS poller process (typically the 'librenms' system user). Additionally, the application fails to validate binary paths, allowing an attacker to substitute the virsh executable path with other binaries (like wget or bash) to achieve code execution or arbitrary file write. Commands are executed automatically during scheduled discovery jobs or can be triggered manually via CLI, making exploitation reliable and difficult to detect.
Affected products
- LibreNMS LibreNMS 23.10.0 through 26.4.0
Timeline
- 2026-08-04: disclosed: GitHub security advisory GHSA-7hmq-j399-mqwf published by maintainer
- 2026-08-26: advisory: CVE-2026-80214 published to NVD
- 2026-04-01: patched: Fix released in LibreNMS 26.4.1