LibreNMS up to 26.3.x Discovery Worker VminfoLibvirt.php exec Hostname os command injection

Summaryinfo

A vulnerability has been found in LibreNMS up to 26.3.x and classified as problematic. This affects the function exec of the file VminfoLibvirt.php of the component Discovery Worker. Performing a manipulation of the argument Hostname results in os command injection. This vulnerability is known as CVE-2026-84194. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability classified as problematic has been found in LibreNMS up to 26.3.x. This affects the function exec of the file VminfoLibvirt.php of the component Discovery Worker. The manipulation of the argument hostname with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery. When libvirt support is enabled (enable_libvirt=true), the device hostname ($this->getDevice()->hostname) is concatenated into shell commands (ssh, virsh list/dumpxml/domstate) in VminfoLibvirt.php and passed to exec() without escapeshellarg() or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands, leading to remote code execution in the discovery worker context.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-84194 since 09/01/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The exploitation requires an enhanced level of successful authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

By approaching the search of inurl:VminfoLibvirt.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 26.4.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• LibreNMS

Version

• 26.0
• 26.1
• 26.2
• 26.3

License

• open-source

Website

• Product: https://github.com/librenms/librenms/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion