Executive brief
LibreNMS is a network monitoring platform that collects and displays device information including routing, process, and service metrics. A stored cross-site scripting vulnerability allows attackers with device management access or ability to enroll a rogue SNMP device to inject malicious JavaScript that executes when administrators view affected pages, enabling theft of SNMP credentials and administrative session tokens.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in legacy PHP template pages that render SNMP-sourced data without HTML escaping. Affected fields include BGP peer descriptions, VRF names, process information, and SLA tags across multiple pages (routing/bgp.inc.php, routing/vrf.inc.php, device/processes.inc.php, device/slas.inc.php). The root cause is the use of raw echo statements without htmlspecialchars() or htmlentities() in legacy PHP templates that predate the migration to Laravel Blade. An attacker with device management privileges or network access to place a rogue SNMP device can inject crafted SNMP values; when any administrator views affected pages, the JavaScript executes in their browser context. Exploitation allows exfiltration of SNMP community strings and CSRF tokens (XSRF-TOKEN is not httponly), or performing authenticated actions via fetch() with the admin's session. The attack requires high privilege prerequisites (device management access or network positioning) and user interaction (admin must view the affected page). No patched versions have been released as of the advisory date.
Affected products
- LibreNMS LibreNMS through 26.2.0
Timeline
- 2026-08-04: disclosed: GitHub Security Advisory GHSA-v5jp-f342-234h published
- 2026-09-01: advisory: CVE-2026-84193 published