CVE-2026-80214: LibreNMS Virtualization Discovery RCE Vulnerability

CVE-2026-80214 Overview

CVE-2026-80214 is an authenticated command injection vulnerability in the LibreNMS Virtualization Discovery module. An authenticated administrator can inject shell metacharacters that the module passes to a system shell during virtualization discovery. Successful exploitation results in arbitrary command execution on the LibreNMS host with the privileges of the web application user. The flaw is tracked under [CWE-78] (Improper Neutralization of Special Elements used in an OS Command). LibreNMS is a widely deployed open source network monitoring platform, so compromise of the host typically exposes stored SNMP credentials, device inventories, and monitoring data.

Critical Impact
Authenticated admin users can execute arbitrary OS commands on the LibreNMS server, leading to full host compromise and exposure of network monitoring credentials.

Affected Products

LibreNMS network monitoring platform
LibreNMS Virtualization Discovery module
LibreNMS releases prior to the fix referenced in advisory GHSA-7hmq-j399-mqwf

Discovery Timeline

2026-08-26 - CVE-2026-80214 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80214

Vulnerability Analysis

The Virtualization Discovery module in LibreNMS assembles operating system commands using attacker-controllable input without adequate neutralization of shell metacharacters. When an authenticated administrator triggers discovery against a target, values that flow into the command line are concatenated into a shell invocation. An attacker who controls those values can append arbitrary commands using separators such as ;, &&, |, or backticks. The resulting process executes under the LibreNMS service account, granting the attacker code execution on the monitoring host.

Root Cause

The root cause is improper neutralization of user-supplied strings passed to an OS command interpreter, categorized as [CWE-78]. The affected code path constructs a shell command from configuration or discovery input rather than invoking the target binary directly with a safely escaped argument array. Because the shell parses the concatenated string, injected metacharacters are interpreted as command syntax instead of literal data.

Attack Vector

Exploitation requires prior authentication with administrator privileges on the LibreNMS web interface. The attack is delivered over the network by submitting a crafted value that reaches the vulnerable Virtualization Discovery routine. No user interaction is required beyond the attacker's own authenticated session. Technical details of the injection sink and a proof of concept are documented in the Project Black research writeup and the upstream GitHub Security Advisory GHSA-7hmq-j399-mqwf.

No verified exploit code is reproduced here. Refer to the linked advisories for the exact parameter and payload construction.

Detection Methods for CVE-2026-80214

Indicators of Compromise

Child processes of the LibreNMS PHP or poller process that spawn shells such as sh -c, bash -c, nc, curl, wget, or python.
Unexpected outbound network connections initiated by the LibreNMS service account.
Modifications to files under the LibreNMS installation directory, cron entries, or the web root that do not correspond to a scheduled update.
Discovery job entries containing shell metacharacters such as ;, |, `, or $( in target or credential fields.

Detection Strategies

Enable and centrally collect process execution telemetry from the LibreNMS host, then alert on shell interpreters spawned as descendants of the PHP-FPM or poller process tree.
Review LibreNMS application logs and web access logs for administrative requests to virtualization discovery endpoints followed by anomalous process activity within seconds.
Baseline the normal command lines invoked by the Virtualization Discovery module and flag deviations.

Monitoring Recommendations

Forward host process, file, and network telemetry to a centralized analytics platform for correlation with LibreNMS audit logs.
Monitor administrator account logins to LibreNMS and alert on new admin sessions from unusual IP addresses or user agents.
Track outbound traffic from monitoring servers, which should normally initiate only SNMP, ICMP, and vendor API traffic to managed devices.

How to Mitigate CVE-2026-80214

Immediate Actions Required

Upgrade LibreNMS to the fixed release identified in GHSA-7hmq-j399-mqwf.
Restrict administrator accounts, rotate LibreNMS admin credentials, and enforce multi-factor authentication on the web console.
Audit recent administrator activity and virtualization discovery configurations for suspicious entries containing shell metacharacters.
Rotate SNMP community strings, API tokens, and device credentials stored in LibreNMS if compromise is suspected.

Patch Information

Apply the LibreNMS update referenced in the vendor advisory GHSA-7hmq-j399-mqwf. The advisory identifies the fixed commit and release. After patching, restart the LibreNMS poller and web services and validate that discovery jobs continue to run against known targets.

Workarounds

Disable the Virtualization Discovery module until the patch is applied.
Limit the number of accounts granted the LibreNMS administrator role and review role assignments.
Place the LibreNMS management interface behind a VPN or IP allowlist so that only trusted operators can reach the admin console.

bash

# Configuration example
# Refer to the upstream advisory for the authoritative fix; the commands below
# illustrate a general remediation workflow for a Git-based LibreNMS install.
cd /opt/librenms
sudo -u librenms git fetch --all --tags
sudo -u librenms git checkout <fixed-release-tag-from-advisory>
sudo -u librenms ./daily.sh
sudo systemctl restart php-fpm nginx