CVE-2026-84191 in LibreNMS
Summary
by MITRE • 09/01/2026
LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary JavaScript through SNMP responses that executes in the browser of any user viewing VRF-related pages.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in LibreNMS versions prior to 26.5.0 represents a critical stored cross-site scripting flaw rooted in inadequate input validation and sanitization mechanisms within the application's network monitoring interface. Specifically, this security defect affects the display logic for Virtual Routing and Forwarding VRF pages where data retrieved via Simple Network Management Protocol SNMP polling is rendered directly into HTML content without proper encoding or filtering. The affected fields include mplsVpnVrfDescription vrf_name and mplsVpnVrfRouteDistinguisher which are extracted from SNMP responses provided by monitored network devices. Because these values originate from external infrastructure components rather than direct user input they were historically perceived as trusted data sources however this assumption proves dangerous in environments where device configurations can be manipulated or compromised allowing an attacker to inject malicious payloads that persist within the application database and execute whenever a legitimate administrator views the affected VRF pages.
From a technical perspective the core issue lies in the failure of the web application framework to apply context-aware output encoding when rendering SNMP-derived attributes into dynamic HTML structures. When an SNMP agent on a monitored router or switch returns crafted string values containing JavaScript code snippets these payloads are stored in the LibreNMS database and subsequently displayed without transformation such as HTML entity encoding or DOM-based sanitization. This allows for persistent execution of arbitrary client-side scripts within the context of the victim user session effectively bypassing same-origin policy protections since the malicious script originates from a trusted domain belonging to the monitoring platform itself. The persistence aspect distinguishes this vulnerability from reflected XSS attacks making it particularly dangerous as each page load triggers the payload without requiring additional interaction beyond viewing the compromised VRF configuration details.
The operational impact of this vulnerability is severe for organizations relying on LibreNMS for network visibility and management. An attacker who gains control over a monitored device or compromises its SNMP community string can achieve remote code execution within the browser context of any authenticated administrator accessing the monitoring dashboard. This capability enables session hijacking through cookie theft credential harvesting via keylogging forms injection into other application features that rely on user input such as configuration updates and potentially full account takeover if multi-factor authentication is not enforced or bypassed. Furthermore because SNMP polling occurs automatically at regular intervals the malicious payload remains active until manually removed from both the device configuration and the LibreNMS database creating a persistent backdoor within the monitoring infrastructure itself which undermines trust in network telemetry data integrity.
This vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting XSS specifically falling under stored or persistent variants where malicious content is saved on target servers and later delivered to users without proper validation it also maps to ATT&CK technique T1059 Command and Scripting Interpreter through JavaScript execution within the browser environment enabling further lateral movement reconnaissance and data exfiltration against internal network assets monitored by LibreNMS. The attack vector leverages legitimate administrative interfaces making detection difficult for traditional web application firewalls that may not inspect SNMP response payloads or recognize them as potential sources of malicious content requiring specialized monitoring rules focused on input validation failures in automated polling mechanisms rather than direct HTTP request manipulation typical of other XSS vectors.
Mitigation strategies must address both immediate remediation and long-term architectural improvements to prevent similar flaws. The primary solution involves upgrading LibreNMS to version 26.5.0 or later where the developers have implemented proper sanitization routines for all SNMP-derived fields before rendering them in web interfaces administrators should also enforce strict access controls limiting who can view VRF configuration pages and rotate SNMP community strings regularly to reduce exposure windows if exploitation occurs temporarily until patching is completed implementing Web Application Firewall rules that detect script injection patterns within SNMP response bodies may provide additional defense-in-depth although this approach carries risk of false positives due to legitimate complex string values in network descriptions. Long-term fixes require adopting secure coding practices such as output encoding based on context HTML attribute URL fragment or JavaScript block validation frameworks like DOMPurify for client-side sanitization and rigorous unit testing covering edge cases involving special characters Unicode sequences and encoded payloads within all external data sources including SNMP syslog API responses and database imports to ensure no untrusted input reaches rendering pipelines without appropriate neutralization procedures.