CVE-2026-109355 Overview
CVE-2026-109355 is a stored cross-site scripting (XSS) vulnerability in LibreNMS versions prior to 26.9.0. The flaw resides in the get_oxidized_nodes_list() function, which renders Oxidized API fields and SNMP sysName values without proper output escaping. An attacker who controls the Oxidized API response or a monitored device's SNMP sysName can inject JavaScript that executes in the browser of any authenticated user viewing the Tools Oxidized page in LibreNMS. The vulnerability maps to [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Stored script injection executes in authenticated LibreNMS user sessions, enabling session hijacking, UI manipulation, and lateral access to monitored infrastructure.
Affected Products
- LibreNMS versions prior to 26.9.0
- Deployments integrating the Oxidized configuration backup service
- Instances monitoring devices with attacker-controllable SNMP sysName values
Discovery Timeline
- 2026-10-12 - CVE-2026-109355 published to the National Vulnerability Database (NVD)
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-109355
Vulnerability Analysis
LibreNMS integrates with Oxidized to collect and display network device configuration backups. The get_oxidized_nodes_list() function fetches node metadata from the Oxidized API and merges it with SNMP-derived attributes such as sysName before rendering the Tools Oxidized page. The function emits these fields directly into HTML without applying contextual output encoding.
Because the data originates from external systems rather than LibreNMS itself, any attacker who can influence either source can persist malicious script content. When an administrator or operator loads the Oxidized page, the browser parses the injected markup and executes attacker-controlled JavaScript in the context of the LibreNMS application.
The stored nature of the issue amplifies impact. Payloads persist across sessions and fire for every user who navigates to the affected view, making the flaw suitable for targeting privileged operators of the monitoring platform.
Root Cause
The root cause is missing output escaping in the rendering path of get_oxidized_nodes_list(). Field values returned by the Oxidized API and SNMP sysName strings are concatenated into the generated HTML without HTML-entity encoding, violating standard output-encoding practices for untrusted data [CWE-79].
Attack Vector
Two attack paths exist. First, an attacker who controls or compromises the upstream Oxidized API can embed script payloads in node metadata fields. Second, an attacker who can set the SNMP sysName of a monitored device, through configuration access or a device compromise, can embed a payload directly into device identification data. Exploitation requires user interaction, specifically an authenticated LibreNMS user loading the Tools Oxidized page.
No verified public exploit code is available. See the GitHub Security Advisory and the Vulncheck Advisory: Stored XSS for upstream technical details.
Detection Methods for CVE-2026-109355
Indicators of Compromise
- SNMP sysName values containing HTML tags, angle brackets, javascript: URIs, or on* event handlers.
- Oxidized API responses with node fields containing <script>, <img>, or <svg> elements.
- Unexpected outbound requests from operator browsers after visiting the Tools Oxidized page.
- LibreNMS web access logs showing repeated loads of the Oxidized tools endpoint followed by anomalous session activity.
Detection Strategies
- Inspect stored device metadata for HTML markup or script syntax in sysName and Oxidized-sourced fields.
- Deploy a Content Security Policy (CSP) in report-only mode and review violations originating from LibreNMS pages.
- Correlate SNMP polling results with change-detection alerts to identify unauthorized sysName modifications.
Monitoring Recommendations
- Monitor LibreNMS and Oxidized integration traffic for unexpected content modifications in API responses.
- Alert on administrator session anomalies such as new cookie exports, token refreshes, or privilege changes after Tools Oxidized page visits.
- Track browser error and network telemetry on operator workstations for script-origin anomalies tied to the monitoring domain.
How to Mitigate CVE-2026-109355
Immediate Actions Required
- Upgrade LibreNMS to version 26.9.0 or later, which contains the fix for get_oxidized_nodes_list().
- Audit existing sysName values and Oxidized node metadata for HTML or script content and sanitize entries before upgrade completes.
- Restrict access to the LibreNMS Tools Oxidized page to a minimal set of authenticated operators until patching finishes.
Patch Information
The vendor fix is included in LibreNMS 26.9.0. Review the GitHub Security Advisory GHSA-cjqw-76mh-jmpv for commit-level patch details and upgrade guidance.
Workarounds
- Harden SNMP configuration on monitored devices to prevent unauthorized modification of sysName.
- Isolate the Oxidized API behind network controls so only trusted LibreNMS hosts can reach it, reducing upstream tampering risk.
- Enforce a restrictive Content Security Policy on the LibreNMS web interface to limit inline script execution.
- Require operators to use dedicated browser profiles with no privileged session cookies when accessing LibreNMS.
# Configuration example
# Upgrade LibreNMS to the patched release
cd /opt/librenms
sudo -u librenms git fetch --tags
sudo -u librenms git checkout 26.9.0
sudo -u librenms ./daily.sh
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
