CVE-2026-26987: LibreNMS Reflected XSS Vulnerability

CVE-2026-26987 Overview

LibreNMS, an auto-discovering PHP/MySQL/SNMP based network monitoring tool, contains a Reflected Cross-Site Scripting (XSS) vulnerability in versions 25.12.0 and below. The vulnerability exists in the email field, allowing attackers to inject malicious scripts that execute in the context of a victim's browser session when they interact with a specially crafted link.

Critical Impact

Attackers can exploit this reflected XSS vulnerability to steal session cookies, capture user credentials, perform actions on behalf of authenticated users, or redirect victims to malicious websites. Given that LibreNMS is typically deployed to monitor critical network infrastructure, successful exploitation could provide attackers with visibility into network topology and device configurations.

Affected Products

• LibreNMS versions 25.12.0 and below
• All LibreNMS installations with web interface exposed
• Environments where users access LibreNMS via untrusted links

Discovery Timeline

• 2026-02-20 - CVE-2026-26987 published to NVD
• 2026-02-20 - Last updated in NVD database

Technical Details for CVE-2026-26987

Vulnerability Analysis

This reflected XSS vulnerability (CWE-79) affects the email field input handling in LibreNMS. Reflected XSS occurs when user-supplied data is immediately returned by the web application without proper sanitization, allowing JavaScript code embedded in the request to execute in the victim's browser. In this case, the email field fails to properly encode or sanitize special characters, enabling injection of arbitrary script content.

The vulnerability requires user interaction—a victim must click on a malicious link containing the XSS payload. When the vulnerable page processes the request, the malicious script executes within the security context of the LibreNMS application, potentially allowing access to session tokens, cookies, and other sensitive data accessible to the authenticated user.

Root Cause

The root cause is improper input validation and output encoding in the LibreNMS web application. The email field component does not adequately sanitize user-controlled input before reflecting it back in the HTTP response. This violates the principle of treating all user input as untrusted and encoding output based on the context where it will be rendered.

Attack Vector

The attack is network-based and requires no prior authentication. An attacker crafts a malicious URL containing JavaScript code in the email field parameter and convinces a victim to click the link. The attack leverages the trust relationship between the user's browser and the LibreNMS server. Since the malicious script originates from the trusted domain, it has full access to the page's DOM and can interact with the application as the authenticated user.

The security patch updates the application's JavaScript bundle and Vue.js components to properly sanitize input in the LibrenmsSetting.vue component:

 </template>
 
 <script>
-import _ from 'lodash';
+import _ from "lodash";
 
 export default {
         name: "LibrenmsSetting",

Source: GitHub Commit 8e626b38

Detection Methods for CVE-2026-26987

Indicators of Compromise

• Unusual URL parameters containing encoded JavaScript or HTML tags in the email field
• Web server logs showing requests with <script>, javascript:, or event handlers (e.g., onerror, onload) in query strings
• User reports of unexpected redirects or pop-ups when accessing LibreNMS
• Session anomalies indicating potential token theft or unauthorized access

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS payloads in request parameters
• Monitor HTTP access logs for suspicious patterns in the email field parameter including encoded special characters
• Deploy browser-based XSS detection tools or Content Security Policy (CSP) violation reporting
• Conduct regular vulnerability scanning of LibreNMS installations to identify unpatched instances

Monitoring Recommendations

• Enable verbose logging on LibreNMS web server to capture full request URLs and parameters
• Configure alerting for unusual authentication patterns that may indicate session hijacking
• Monitor for outbound connections to unknown domains from user browsers accessing LibreNMS
• Review CSP reports if implemented to identify blocked XSS attempts

How to Mitigate CVE-2026-26987

Immediate Actions Required

• Upgrade LibreNMS to version 26.2.0 or later immediately
• Review web server access logs for signs of exploitation attempts targeting the email field
• Implement Content Security Policy headers to reduce XSS impact as a defense-in-depth measure
• Educate users about the risks of clicking untrusted links to the LibreNMS interface

Patch Information

LibreNMS has released version 26.2.0 which addresses this vulnerability. The fix is available through the official LibreNMS repository. The security patch can be reviewed in GitHub Pull Request #19038, and the full release is available at GitHub Release 26.2.0. For detailed vulnerability information, refer to the GitHub Security Advisory GHSA-gqx7-99jw-6fpr.

Workarounds

• Implement a Web Application Firewall (WAF) with XSS filtering rules in front of LibreNMS
• Add Content-Security-Policy headers to restrict inline script execution
• Limit access to the LibreNMS web interface to trusted networks only via firewall rules
• Use browser extensions that block reflected XSS attacks for users who must access vulnerable instances

# Example nginx Content-Security-Policy header configuration
# Add to server block for LibreNMS
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';" always;

# Example Apache configuration
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"