CVE-2026-84188 in LibreNMS
Summary
by MITRE • 09/01/2026
LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr.<graphtype> configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs.inc.php. An administrator can store a malicious HTML payload that executes in the browser of any authenticated user who views the affected graph type. The issue is fixed in version 26.7.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in LibreNMS versions up to and including 26.4.0 represents a significant security flaw within the network monitoring application's web interface, specifically categorized as a stored cross-site scripting (XSS) attack vector. This type of vulnerability arises when an application stores untrusted data without performing adequate validation or encoding before rendering it in subsequent HTTP responses. In this specific instance, the defect is located within the graph_descr configuration settings associated with various graphtypes. These fields are designed to allow administrators to input descriptive text for network graphs, but the underlying implementation fails to sanitize user-supplied content properly. The root cause lies in the file includes/html/pages/graphs.inc.php, where the stored description data is echoed directly into the HTML output without applying necessary HTML escaping mechanisms. This lack of encoding allows malicious scripts embedded within the configuration fields to be interpreted and executed by web browsers rather than being treated as inert text data.
The operational impact of this vulnerability is substantial due to its persistent nature and the privilege level required for exploitation. Because the payload is stored on the server side, it does not require complex social engineering or link manipulation typical of reflected XSS attacks. Instead, any authenticated user who accesses a graph associated with the compromised graphtype will automatically trigger the execution of the malicious script in their browser session. While the initial input requires administrator privileges to store the payload, the impact extends to all users with access to view those specific graphs. This can lead to severe consequences such as session hijacking, where attackers steal authentication cookies or tokens to impersonate legitimate users. It also enables credential theft through fake login forms injected into the page context, keylogging capabilities that capture sensitive information typed by victims, and defacement of the user interface. The persistence of the payload means that every subsequent visit to the affected graph serves as a new attack vector until the malicious configuration is manually removed or patched.
From an industry standards perspective, this vulnerability aligns with CWE-79, which defines Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism here involves stored XSS, where the application acts as a conduit for delivering malware to victims by storing malicious content in its database or configuration files. In terms of tactical mapping within the MITRE ATT&CK framework, this vulnerability facilitates techniques related to Collection via Browser Redirects and potentially Credential Access through phishing if combined with social engineering elements that leverage the trusted appearance of the LibreNMS interface. The attacker leverages the trust users place in internal monitoring tools to bypass security controls that might otherwise filter external traffic, exploiting the fact that requests originate from within the network perimeter or are authenticated by legitimate credentials.
Mitigation strategies for this vulnerability primarily involve upgrading the LibreNMS installation to version 26.7.0 or later, where the developers have implemented proper input sanitization and output encoding practices. For environments unable to upgrade immediately due to compatibility constraints, temporary mitigations should focus on strict access control policies limiting who can modify graph descriptions. Implementing a Web Application Firewall with rules capable of detecting and blocking common XSS payloads in POST requests targeting configuration endpoints may provide an additional layer of defense. Furthermore, administrators should audit existing configurations for any suspicious entries that might indicate prior exploitation attempts. Long-term remediation requires adopting secure coding standards such as OWASP Top Ten guidelines, ensuring that all dynamic content is contextually encoded before being rendered by the browser to prevent script injection regardless of the source's perceived trustworthiness.