CVE-2026-26992: LibreNMS Stored XSS Vulnerability

CVE-2026-26992 Overview

CVE-2026-26992 is a Stored Cross-Site Scripting (XSS) vulnerability affecting LibreNMS, an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the port group name is not properly sanitized, allowing attackers with admin privileges to inject malicious scripts that execute when other users interact with the port group interface.

When a user adds a port group, an HTTP POST request is sent to the Request-URI /port-groups. The name of the newly created port group is stored in the value of the name parameter without proper sanitization. After the port group is created, the entry is displayed along with relevant buttons such as Edit and Delete, causing the injected script to execute in the context of any user viewing or interacting with these elements.

Critical Impact
Attackers with admin privileges can inject persistent malicious scripts that execute in the browsers of other administrators or users viewing the port groups interface, potentially leading to session hijacking, credential theft, or unauthorized actions.

Affected Products

LibreNMS versions 26.1.1 and below
LibreNMS port group management component
All LibreNMS installations with admin user access to port group features

Discovery Timeline

2026-02-20 - CVE CVE-2026-26992 published to NVD
2026-02-20 - Last updated in NVD database

Technical Details for CVE-2026-26992

Vulnerability Analysis

This Stored XSS vulnerability exists in the LibreNMS port group management functionality. The root issue stems from insufficient input sanitization when processing and displaying port group names. When an administrator creates or modifies a port group, the name parameter value is stored directly in the database and later rendered in the web interface without proper output encoding.

The vulnerability is exploitable via the network by authenticated users with admin privileges. The attack requires some user interaction, as a victim must view or interact with the port groups page where the malicious content is displayed. While the attack requires administrative privileges to inject the payload, the stored nature of this XSS means it persists and affects any subsequent users who access the affected page.

Root Cause

The vulnerability originates from improper output encoding in the Blade template file resources/views/port-group/index.blade.php. The port group name was being passed directly into JavaScript function calls within the onclick event handler without proper escaping, allowing attackers to break out of the string context and inject arbitrary JavaScript code.

Attack Vector

The attack is conducted over the network through the LibreNMS web interface. An attacker with admin credentials can navigate to the port groups management page and create a new port group with a malicious name containing JavaScript code. The payload is stored server-side and executes whenever any user clicks the delete button for that port group, as the malicious name is rendered unsafely in the button's onclick attribute.

php

// Vulnerable code - port group name passed directly to onclick handler
onclick="delete_pg(this, '{{ $port_group->name }}', '{{ route('port-groups.destroy', $port_group->id) }}')"

// Fixed code - name moved to data attribute for safe access
data-group-name="{{ $port_group->name }}"
onclick="delete_pg(this, '{{ route('port-groups.destroy', $port_group->id) }}')"

Source: GitHub Commit 882fe6f

Detection Methods for CVE-2026-26992

Indicators of Compromise

Unusual or suspicious characters in port group names including <script>, javascript:, or encoded variants
Port group names containing HTML tags, event handlers, or JavaScript code
Unexpected JavaScript execution or browser alerts when viewing the port groups page
Audit log entries showing port group creation with potentially malicious name patterns

Detection Strategies

Implement web application firewall (WAF) rules to detect XSS payloads in POST requests to /port-groups endpoint
Review LibreNMS audit logs for port group creation and modification events with suspicious names
Deploy browser-based XSS detection tools or Content Security Policy (CSP) violation reporting
Scan the port_groups database table for entries containing script tags or JavaScript code

Monitoring Recommendations

Enable and monitor LibreNMS application logs for unusual administrative activities
Configure alerts for multiple port group creation events in short time periods
Implement Content Security Policy headers and monitor for policy violations
Regularly audit port group names in the database for suspicious content

How to Mitigate CVE-2026-26992

Immediate Actions Required

Upgrade LibreNMS to version 26.2.0 or later immediately
Review existing port group names in the database for any potentially malicious content
Audit recent administrative actions in LibreNMS logs for suspicious port group modifications
Consider temporarily restricting admin access until the patch is applied

Patch Information

The vulnerability has been fixed in LibreNMS version 26.2.0. The fix modifies the Blade template to use a data attribute (data-group-name) instead of directly embedding the port group name in the JavaScript onclick handler. This approach ensures proper HTML encoding of the name value, preventing XSS payload execution.

The security patch is available via commit 882fe6f90ea504a3732f83caf89bba7850a5699f. For detailed information, refer to the GitHub Security Advisory GHSA-93fx-g747-695x and the GitHub Release 26.2.0.

Workarounds

Limit administrative access to trusted users only until the patch can be applied
Implement Content Security Policy headers to mitigate XSS impact as a defense-in-depth measure
Deploy a web application firewall with XSS filtering rules for the LibreNMS application
Regularly review and sanitize existing port group names in the database

bash

# Upgrade LibreNMS to patched version
cd /opt/librenms
git fetch --all
git checkout 26.2.0
./scripts/composer_wrapper.php install --no-dev
./lnms migrate