CVE-2026-84193 in LibreNMS
Summary
by MITRE • 09/01/2026
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enroll a rogue SNMP device can inject malicious JavaScript that executes when admins view affected routing and device pages, enabling credential theft and CSRF token exfiltration.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in LibreNMS versions through 26.2.0 represents a critical security flaw rooted in the improper handling of untrusted input within legacy PHP template files. This stored cross-site scripting (XSS) issue specifically affects pages that render data sourced from Simple Network Management Protocol SNMP queries, including BGP peer descriptions, VRF names, process information, and SLA tags. The core technical failure lies in the absence of proper output encoding or escaping mechanisms when these dynamic fields are injected into HTML contexts. Because the application trusts the data retrieved via SNMP without validating its content against a whitelist of safe characters, it allows malicious scripts to be persisted within the database and subsequently executed by any user with access to the affected interfaces. This architectural oversight transforms routine network monitoring functions into vectors for client-side code execution, fundamentally compromising the integrity of the web application's security model.
The operational impact of this vulnerability is severe due to its stored nature and the high privilege level typically associated with administrators who view these pages. An attacker does not need direct access to the LibreNMS interface initially; instead, they can exploit network-level access by enrolling a rogue SNMP device into the monitoring system. Once enrolled, the attacker configures the device to return malicious JavaScript payloads within standard SNMP response fields such as BGP peer descriptions or VRF names. When an administrator navigates to routing or device pages that display this data, the browser executes the injected script in the context of the LibreNMS domain. This enables session hijacking through credential theft, allowing the attacker to impersonate legitimate users and gain full control over the monitoring infrastructure. Furthermore, because modern web applications often rely on Cross-Site Request Forgery tokens for state-changing operations, the ability to execute arbitrary JavaScript allows attackers to exfiltrate these CSRF tokens, facilitating further attacks such as unauthorized configuration changes or data deletion without requiring additional authentication steps during those specific actions.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The stored variant indicates that the malicious payload is saved on the target server, making it persistent and affecting multiple victims rather than just the initial attacker. In terms of tactical mapping to the MITRE ATT&CK framework, this exploit falls under T1059 Command and Scripting Interpreter via JavaScript execution within a browser context. The attack chain begins with Initial Access through network-level SNMP interaction (T1190 Exploit Public-Facing Application), followed by Execution as the script runs in the victim's browser, leading to Credential Access (T1056 Input Capture) and potentially Privilege Escalation if combined with CSRF token theft. The reliance on legacy PHP templates highlights a broader issue of technical debt where older code paths may lack modern security controls like Content Security Policy headers or robust input validation libraries that are present in newer application components.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Administrators should immediately apply the vendor-provided patch for LibreNMS version 26.2.1 or later, which corrects the output encoding logic in the affected legacy templates. In environments where patching is not instantly feasible, network segmentation can limit exposure by restricting SNMP access to trusted management stations only, preventing attackers from enrolling rogue devices that serve as injection vectors. Additionally, implementing a strict Content Security Policy header with directives such as script-src 'self' can significantly reduce the impact of any successfully injected scripts by preventing them from loading external resources or executing inline code unless explicitly allowed. Long-term resolution requires refactoring legacy PHP templates to use modern templating engines that enforce automatic escaping and replacing direct SNMP data rendering with validated, sanitized inputs derived from a controlled schema. Regular security audits focusing on input validation across all user-facing endpoints are essential to prevent similar vulnerabilities in other modules of the application.