CVE-2026-84194: LibreNMS OS command injection in libvirt discovery

CVE-2026-84194 · Severity: info · CVSS 8.6 · Published 2026-09-01

LibreNMS is an open-source network monitoring platform used to track and visualize network devices and services. When libvirt support is enabled, an authenticated admin can inject arbitrary operating system commands through a crafted device hostname, resulting in remote code execution with the privileges of the discovery worker process. An attacker could read sensitive configuration files, modify monitoring settings, or establish persistence on the monitoring infrastructure.

Technologies: Librenms. Vendors: Librenms.

Quick answers

Is CVE-2026-84194 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84194 being exploited in the wild.
How severe is CVE-2026-84194?
Informational severity, with a CVSS score of 8.6, published 1 September 2026.
Which products and versions are affected?
Librenms >= 23.10.0, < 26.4.0.
Is there a fix for CVE-2026-84194?
A patch was published on 2026-09-01: Fix available in version 26.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84194 attacked?
It is attacked over the network.
Am I affected by CVE-2026-84194?
Check whether you run Librenms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in the VminfoLibvirt.php component where the device hostname is concatenated directly into shell commands (ssh, virsh list, virsh dumpxml, virsh domstate) and passed to exec() without proper escaping using escapeshellarg() or argument separation. The vulnerability requires an authenticated admin who can call the /api/v0/devices endpoint to create or modify a device with a malicious hostname, then trigger the libvirt discovery via the /api/v0/devices/{id}/discover API endpoint. The injected payload executes in the context of the discovery worker with LibreNMS process privileges. Patches are available in version 26.4.0 and later.

Affected products

  • LibreNMS LibreNMS >= 23.10.0, < 26.4.0

Timeline

  • 2026-08-04: disclosed: GitHub Security Advisory GHSA-wff2-9gjr-95f3 published
  • 2026-09-01: advisory: CVE-2026-84194 published
  • 2026-09-01: patched: Fix available in version 26.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.