Is CVE-2026-84191 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84191 being exploited in the wild.

How severe is CVE-2026-84191?

Medium severity, with a CVSS score of 6.1, published 1 September 2026.

Is there a fix for CVE-2026-84191?

A patch was published on 2026-26.5.0: Patched in version 26.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84191 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84191?

Check whether you run Librenms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84191: LibreNMS stored XSS in VRF display pages

CVE-2026-84191 · Severity: medium · CVSS 6.1 · Published 2026-09-01

LibreNMS is network monitoring and management software that collects data from network devices via SNMP. This vulnerability allows an attacker controlling a monitored device to inject malicious JavaScript into VRF (Virtual Routing and Forwarding) configuration fields, which then executes in the browsers of any LibreNMS user viewing those pages. An attacker could steal administrator session cookies, create unauthorized accounts, or gather sensitive network information from the monitoring system.

Technologies: Librenms. Vendors: Librenms.

Quick answers

Is CVE-2026-84191 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84191 being exploited in the wild.
How severe is CVE-2026-84191?: Medium severity, with a CVSS score of 6.1, published 1 September 2026.
Which products and versions are affected?: Librenms before 26.5.0.
Is there a fix for CVE-2026-84191?: A patch was published on 2026-26.5.0: Patched in version 26.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84191 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84191?: Check whether you run Librenms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a stored cross-site scripting (XSS) vulnerability in LibreNMS's VRF display functionality. The mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher fields are collected from SNMP responses during device discovery and stored in the database without sanitization. When displayed on VRF pages in includes/html/print-vrf.inc.php and includes/html/pages/routing/vrf.inc.php, these fields are echoed directly into HTML and JavaScript contexts without htmlspecialchars() or htmlentities() escaping. An attacker with control of a monitored network device (or via MITM on SNMPv1/v2c) can inject arbitrary JavaScript through SNMP responses; the payload persists in the database and executes whenever any authenticated user views VRF pages. Patch: upgrade to LibreNMS 26.5.0 or later.

Affected products

LibreNMS LibreNMS before 26.5.0

Timeline

2026-08-04: disclosed
2026-26.5.: patched: Patched in version 26.5.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.