Executive brief
LibreNMS is an open-source network monitoring platform used to track and visualize network devices and services. When libvirt support is enabled, an authenticated admin can inject arbitrary operating system commands through a crafted device hostname, resulting in remote code execution with the privileges of the discovery worker process. An attacker could read sensitive configuration files, modify monitoring settings, or establish persistence on the monitoring infrastructure.
Technical details
A command injection vulnerability exists in the VminfoLibvirt.php component where the device hostname is concatenated directly into shell commands (ssh, virsh list, virsh dumpxml, virsh domstate) and passed to exec() without proper escaping using escapeshellarg() or argument separation. The vulnerability requires an authenticated admin who can call the /api/v0/devices endpoint to create or modify a device with a malicious hostname, then trigger the libvirt discovery via the /api/v0/devices/{id}/discover API endpoint. The injected payload executes in the context of the discovery worker with LibreNMS process privileges. Patches are available in version 26.4.0 and later.
Affected products
- LibreNMS LibreNMS >= 23.10.0, < 26.4.0
Timeline
- 2026-08-04: disclosed: GitHub Security Advisory GHSA-wff2-9gjr-95f3 published
- 2026-09-01: advisory: CVE-2026-84194 published
- 2026-09-01: patched: Fix available in version 26.4.0