CVE-2026-55182: LibreNMS Signal Alert Transport RCE Vulnerability

CVE-2026-55182 Overview

CVE-2026-55182 is a command injection vulnerability [CWE-77] in LibreNMS, an open-source network monitoring system. The flaw resides in the Signal alert transport, where the signal-cli path and Recipient field are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry containing shell metacharacters and point the path to the bundled composer_wrapper.php script, which itself invokes unsafe exec calls. Chaining these calls allows arbitrary operating-system command execution on the LibreNMS host. The issue affects versions from 21.6.0 up to 26.5.0 and is fixed in version 26.5.0.

Critical Impact
Authenticated administrators can execute arbitrary OS commands on the LibreNMS host, leading to full compromise of the monitoring server and any credentials it stores.

Affected Products

LibreNMS versions 21.6.0 through 26.4.x
LibreNMS Signal alert transport component
LibreNMS bundled scripts/composer_wrapper.php

Discovery Timeline

2026-08-26 - CVE-2026-55182 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-55182

Vulnerability Analysis

LibreNMS supports alert delivery through multiple transports, including Signal via the signal-cli command-line tool. When an administrator configures the Signal transport, LibreNMS builds a shell command that includes the configured signal-cli path and the Recipient field. Both values are concatenated into an exec invocation without adequate escaping, allowing shell metacharacters such as ;, |, &, and backticks to break out of the intended command context.

The attack becomes reliable when the administrator points the signal-cli path at the repository-bundled scripts/composer_wrapper.php. That helper script itself constructs shell commands from its arguments without escaping, so an attacker can chain injections through it to run arbitrary binaries with the privileges of the LibreNMS web or worker process.

Root Cause

The root cause is missing input neutralization on two independent code paths. The alert transport builder concatenates the transport path and Recipient directly into a shell string, and composer_wrapper.php builds $exec from $install_dir using single-quote wrapping rather than escapeshellarg. Neither layer enforces argument boundaries, so operator characters in either input are interpreted by the shell.

Attack Vector

Exploitation requires authenticated administrator access to LibreNMS. The attacker creates or edits a Signal alert transport, sets the path to scripts/composer_wrapper.php, and embeds shell metacharacters in the Recipient field. Triggering a test alert or a normal alert firing causes LibreNMS to execute the crafted command, giving the attacker code execution on the monitoring host.

php

// Patch in scripts/composer_wrapper.php - Composer wrapper escape args (#19663)
if (is_file($install_dir . '/composer.phar')) {
-    $exec = PHP_BINARY . " '" . $install_dir . "/composer.phar'";
+    $exec = PHP_BINARY . ' ' . escapeshellarg($install_dir . '/composer.phar');

    // If older than 1 week, try update
    if (time() - filemtime($install_dir . '/composer.phar') > 60 * 60 * 24 * 7) {

Source: LibreNMS commit 868e3b966a. The patch replaces single-quote wrapping with escapeshellarg, ensuring attacker-controlled path segments cannot terminate the quoted argument and inject additional shell tokens.

Detection Methods for CVE-2026-55182

Indicators of Compromise

Signal alert transport entries where the path field references composer_wrapper.php or any file outside /usr/bin/signal-cli
Recipient fields containing shell metacharacters such as ;, |, &, $(, or backticks
Unexpected child processes of the LibreNMS PHP worker (php, php-fpm, or librenms cron user) spawning shells, curl, wget, bash, or nc
New or modified files under the LibreNMS installation directory owned by the web user outside deployment windows

Detection Strategies

Audit the alert_transports database table for Signal transport rows and inspect the transport_config JSON for suspicious signal-cli paths or Recipient values
Review LibreNMS logs/librenms.log and web server access logs for POST requests to /alert-transports or /alerts/transports endpoints followed by test-transport activity
Correlate alert-firing events with process creation telemetry to identify command execution originating from the alerting subsystem

Monitoring Recommendations

Enable process-execution telemetry on the LibreNMS host and alert on shells launched by the web or cron user with unusual command lines
Monitor administrator logins to the LibreNMS UI and flag changes to alert transport configuration for review
Watch for outbound network connections from the LibreNMS server to non-monitoring destinations, which may indicate post-exploitation staging

How to Mitigate CVE-2026-55182

Immediate Actions Required

Upgrade LibreNMS to version 26.5.0 or later, which contains the escaping fix in composer_wrapper.php and the Signal transport
Review all existing Signal alert transport entries and remove any that reference composer_wrapper.php or contain shell metacharacters in the Recipient field
Rotate credentials, API tokens, and SNMP community strings stored by LibreNMS if unauthorized administrator activity is suspected
Restrict administrator role assignment to the minimum required set of users and enforce multi-factor authentication on those accounts

Patch Information

The fix is available in LibreNMS 26.5.0 and documented in GHSA-c9fv-cgmm-2wg7. The corrective commit is 868e3b966a, which introduces escapeshellarg around user- and configuration-controlled arguments in the composer wrapper and hardens the Signal transport builder.

Workarounds

Disable the Signal alert transport until the upgrade is applied by removing configured Signal transport entries
Constrain the LibreNMS service account with a restrictive shell, mandatory access controls (AppArmor or SELinux), and no write access to system binaries
Place the LibreNMS web UI behind a reverse proxy that restricts administrative endpoints to trusted source networks

bash

# Upgrade LibreNMS to the patched release
cd /opt/librenms
sudo -u librenms git fetch --tags
sudo -u librenms git checkout 26.5.0
sudo -u librenms ./scripts/composer_wrapper.php install --no-dev
sudo systemctl restart librenms.service nginx php-fpm