CVE-2026-109355 in LibreNMS
Summary
by MITRE • 10/12/2026
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the Tools Oxidized page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in LibreNMS versions prior to 26.9.0 represents a critical stored cross-site scripting flaw located within the get_oxidized_nodes_list() function. This security defect arises from an insufficient sanitization of user-controllable input, specifically data retrieved from external sources such as the Oxidized API and SNMP sysName attributes. In web application architecture, stored XSS occurs when malicious scripts are permanently stored on the target server, typically in a database or log file, and subsequently served to users without proper encoding. In this specific instance, the application fails to escape HTML special characters within fields that originate from the Oxidized configuration management tool and Simple Network Management Protocol devices. Consequently, any script injected into these data streams is rendered directly by the browser when an administrator accesses the Tools Oxidized page, leading to unauthorized execution of client-side code in the context of the victim's session.
From a technical perspective, the root cause lies in the lack of output encoding for dynamic content derived from external APIs and network device metadata. When LibreNMS queries the Oxidized API or retrieves SNMP sysName values, it treats these inputs as trusted data without applying necessary HTML entity encoding functions such as htmlspecialchars() or equivalent mechanisms depending on the framework used. This oversight allows an attacker who has control over the Oxidized response payload or can manipulate the SNMP sysName of a monitored device to inject arbitrary JavaScript code. The malicious script is stored within the LibreNMS database and becomes part of the page content served to any user with access privileges to view the Oxidized tools interface, thereby bypassing same-origin policy protections inherent in modern browsers.
The operational impact of this vulnerability is severe due to its persistent nature and high-privilege target audience. Since the script executes within the browser session of administrators or users viewing the specific page, attackers can steal sensitive authentication cookies, session tokens, or multi-factor authentication codes. This capability facilitates account takeover, allowing adversaries to impersonate legitimate users and gain full administrative control over the network monitoring infrastructure. Furthermore, the attacker could perform actions on behalf of the victim, such as modifying device configurations, altering alert thresholds, or exfiltrating internal network topology data visible through LibreNMS interfaces. The ability to execute arbitrary JavaScript also opens avenues for phishing attacks within the application interface itself, potentially tricking users into revealing credentials or downloading malware under false pretenses presented by the compromised page content.
This vulnerability aligns with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). Specifically, it falls under stored XSS variants where malicious input is persisted in a database and later retrieved for display. In terms of the MITRE ATT&CK framework, this exploit maps to T1059 Command and Control Execution via JavaScript, allowing attackers to execute commands within the browser environment, and potentially T1078 Valid Accounts if used to escalate privileges or maintain persistence through session hijacking. The attack vector is classified as remote with low complexity but requires either control over an external Oxidized instance or access to modify SNMP sysName values on managed devices, which may involve lateral movement within the network if initial entry points are limited.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. The primary solution is to upgrade LibreNMS to version 26.9.0 or later, where this specific input validation flaw has been addressed by developers through proper output encoding mechanisms. For environments unable to patch immediately, implementing a Web Application Firewall with rules capable of detecting and blocking script injection patterns in HTTP responses may provide temporary relief, though this is not a substitute for code-level fixes. Developers should enforce strict whitelisting or robust HTML entity encoding on all data originating from external APIs like Oxidized and SNMP before rendering it in the DOM. Additionally, implementing Content Security Policy headers can restrict the execution of inline scripts, thereby mitigating the impact even if an injection attempt succeeds. Regular security audits focusing on input validation and output encoding across all integrations are essential to prevent similar vulnerabilities in network management software.