CVE-2026-84189: LibreNMS stored XSS in Oxidized integration

CVE-2026-84189 · Severity: high · CVSS 8.1 · Published 2026-09-01

LibreNMS is a network monitoring application that integrates with Oxidized, a configuration management system. An administrator can configure LibreNMS to fetch device data from an external Oxidized server. If an attacker can trick the administrator into pointing this URL to an attacker-controlled server, the attacker can inject malicious code that will execute in the browsers of all users who view device configuration pages, potentially allowing theft of session credentials or unauthorized actions on the monitoring system.

Technologies: Librenms, librenms/librenms (Packagist). Vendors: Librenms, Packagist.

Quick answers

Is CVE-2026-84189 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84189 being exploited in the wild.
How severe is CVE-2026-84189?
High severity, with a CVSS score of 8.1, published 1 September 2026.
Which products and versions are affected?
Librenms through 26.4.0; librenms/librenms (Packagist) ECOSYSTEM:introduced=0,fixed=26.7.0.
Is there a fix for CVE-2026-84189?
Yes. librenms/librenms (Packagist): upgrade to 26.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84189 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-84189?
Check whether you run Librenms or librenms/librenms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • librenms/librenms (Packagist): upgrade to 26.7.0 or later
    composer require librenms/librenms:^26.7.0

Technical details

LibreNMS contains a stored cross-site scripting (XSS) vulnerability in the device showconfig page. The vulnerability exists in the Oxidized integration code (includes/html/pages/device/showconfig.inc.php, lines 276–278 and others) which renders JSON fields (name, ip, model, author, commit message) from the admin-configurable Oxidized API without HTML escaping. An administrator pointing the oxidized.url setting at an attacker-controlled server allows the attacker to return malicious JSON payloads. Since the returned data is embedded directly into HTML output without htmlspecialchars(), any user viewing any device's showconfig tab will have the malicious script executed in their browser context. This requires high privileges (admin configuration access) but affects all regular users. The vulnerability was fixed in version 26.7.0 by applying htmlspecialchars() with ENT_QUOTES to all untrusted fields.

Affected products

  • LibreNMS LibreNMS through 26.4.0

Identifiers

  • CVE-2026-84189
  • GHSA-7gww-x7fh-jf9j

Timeline

  • 2026-08-04: disclosed: GitHub Security Advisory GHSA-7gww-x7fh-jf9j published
  • 2026-09-01: advisory: NVD entry published
  • 2026-09-01: patched: Fixed in version 26.7.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.