CVE-2026-45694: LibreNMS Reflected XSS Vulnerability

CVE-2026-45694 Overview

CVE-2026-45694 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in LibreNMS, an open-source network monitoring system. The flaw affects the Proxmox application view in versions up to and including 26.4.0. User-supplied instance and vmid GET parameters are reflected into the page title with only strip_tags applied, then interpolated into an inline document.title JavaScript assignment. A single quote in attacker input terminates the JavaScript string and executes arbitrary script in the victim's browser session. The issue is fixed in version 26.5.0.

Critical Impact
An authenticated user who follows a crafted link executes attacker-controlled JavaScript in their LibreNMS session, enabling session data theft and actions performed as the victim.

Affected Products

LibreNMS versions up to and including 26.4.0
Proxmox application view component (app/Http/Controllers/LegacyController.php)
Fixed in LibreNMS 26.5.0

Discovery Timeline

2026-08-26 - CVE-2026-45694 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-45694

Vulnerability Analysis

The vulnerability resides in LibreNMS's legacy controller handling of the Proxmox application view. The application reads the instance and vmid GET parameters and places them into the page title. Only strip_tags is applied to the input, which removes HTML tags but does not encode JavaScript-relevant characters such as single quotes, backslashes, or newlines.

The unsanitized title is then written into an inline document.title = '...' assignment through string interpolation. Because the value sits inside a JavaScript single-quoted string, a single quote in the parameter closes the string literal early. Any content that follows executes as JavaScript in the context of the authenticated LibreNMS session.

Exploitation requires an authenticated victim to follow a crafted link. The attacker-controlled script runs with the victim's LibreNMS privileges, allowing session token exfiltration, CSRF-style actions against monitoring configuration, and read access to network telemetry visible to the victim.

Root Cause

The root cause is reliance on strip_tags as the sole sanitization step for values embedded in a JavaScript execution context. strip_tags targets HTML tag removal and does not escape quote characters, so it cannot safely produce values for JavaScript string literals. The fix imports Laravel's Illuminate\Support\Js helper, which JSON-encodes values for safe inline JavaScript output.

Attack Vector

The attack is network-based and requires user interaction. An attacker crafts a URL to the vulnerable Proxmox view with a malicious instance or vmid parameter containing a single quote followed by JavaScript. The attacker delivers the link through phishing, chat, or a compromised page. When an authenticated LibreNMS user clicks the link, the script executes in their browser.

php

// Patch: app/Http/Controllers/LegacyController.php
// Source: https://github.com/librenms/librenms/commit/0be1bfd7746cea26bf7da40e82b70f75b724d0f8
 use Illuminate\Contracts\Session\Session;
 use Illuminate\Http\Request;
 use Illuminate\Support\Arr;
+use Illuminate\Support\Js;
 use Illuminate\Support\Str;
 use LibreNMS\Util\Debug;

The patch introduces the Illuminate\Support\Js helper, which the fixed code uses to safely encode the page title value for inline JavaScript context.

Detection Methods for CVE-2026-45694

Indicators of Compromise

Web server access logs containing requests to Proxmox application view URLs with instance or vmid parameters that include single quotes, %27, backslashes, or JavaScript keywords such as alert, document.cookie, or fetch.
Referer headers pointing to external phishing domains preceding requests to LibreNMS Proxmox pages.
Outbound connections from user browsers to attacker-controlled hosts immediately after a LibreNMS session was active.

Detection Strategies

Deploy web application firewall (WAF) rules that flag single quotes, angle brackets, and JavaScript event handlers in instance and vmid query parameters.
Parse HTTP access logs for LibreNMS Proxmox routes and alert on URL-encoded quote characters or script fragments in query strings.
Correlate authenticated user sessions with anomalous outbound requests originating from browsers shortly after LibreNMS activity.

Monitoring Recommendations

Enable verbose access logging on the LibreNMS front-end web server and forward logs to a centralized analytics platform.
Monitor for unusual session token usage patterns, such as tokens seen from new IP addresses or user agents within minutes of a suspicious click.
Track LibreNMS audit logs for unexpected configuration changes performed by user accounts that recently visited crafted URLs.

How to Mitigate CVE-2026-45694

Immediate Actions Required

Upgrade LibreNMS to version 26.5.0 or later, which contains the fix.
Rotate active LibreNMS user session cookies and API tokens if exploitation is suspected.
Review recent LibreNMS audit and configuration logs for changes made by users who may have followed suspicious links.

Patch Information

The vulnerability is remediated in LibreNMS 26.5.0. The fix, referenced in the GitHub Security Advisory GHSA-jmqm-f8q4-v7wx and applied in commit 0be1bfd, replaces unsafe string interpolation with Laravel's Illuminate\Support\Js helper for encoding values injected into inline JavaScript.

Workarounds

Restrict access to the LibreNMS web interface to trusted management networks using firewall or VPN controls until the patch is applied.
Deploy a WAF rule that rejects requests to Proxmox application URLs whose instance or vmid parameters contain single quotes, backslashes, or angle brackets.
Enforce a strict Content Security Policy (CSP) that disallows inline script execution to reduce the impact of reflected XSS.

bash

# Example: upgrade LibreNMS via git to the fixed release
cd /opt/librenms
sudo -u librenms git fetch --tags
sudo -u librenms git checkout 26.5.0
sudo -u librenms ./daily.sh
sudo systemctl restart nginx php-fpm