CVE-2026-84189 librenms CVE debrief

Who should care

Administrators and users of LibreNMS, especially those who view device showconfig pages, should be aware of this vulnerability and take necessary actions to update and protect their systems. Security teams and vulnerability management teams should also review the vulnerability and assess potential impact on their systems and networks. Additionally, operators and platform administrators should review the vulnerability and assess potential impact on their systems and networks.

Technical summary

LibreNMS through version 26.4.0 is vulnerable to stored cross-site scripting via the Oxidized integration URL. An administrator who points the Oxidized URL at an attacker-controlled server can cause it to return malicious JSON, resulting in persistent XSS affecting all users who view any device's showconfig tab. The issue is fixed in version 26.7.0. Affected systems should be updated to prevent exploitation. The vulnerability exists due to improper handling of JSON fields returned by the Oxidized integration URL.

Defensive priority

Administrators should prioritize updating LibreNMS to version 26.7.0 or later to address the stored cross-site scripting vulnerability.

Recommended defensive actions

• Update LibreNMS to version 26.7.0 or later
• Review and restrict Oxidized integration URL access
• Monitor for suspicious activity on device showconfig pages
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in LibreNMS through version 26.4.0, where JSON fields returned by the Oxidized integration URL are rendered without applying htmlspecialchars(), allowing for stored cross-site scripting. The issue is fixed in version 26.7.0. Evidence is based on official CVE Program record and NVD vulnerability detail. Further verification is recommended to confirm affected deployments and assess potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.