CVE-2026-84188 Overview
CVE-2026-84188 is a stored cross-site scripting (XSS) vulnerability in LibreNMS, an open-source network monitoring platform. Versions up to and including 26.4.0 fail to HTML-escape the graph_descr.<graphtype> configuration values before rendering them in includes/html/pages/graphs.inc.php. An administrator can persist a malicious HTML or JavaScript payload in these settings. The payload then executes in the browser of any authenticated user who views the affected graph type. The issue is classified as CWE-79 and is resolved in LibreNMS version 26.7.0.
Critical Impact
Authenticated administrator input is echoed verbatim into rendered HTML, enabling script execution in any authenticated user's browser session.
Affected Products
- LibreNMS versions <= 26.4.0
- LibreNMS network monitoring web interface (includes/html/pages/graphs.inc.php)
- Fixed in LibreNMS version 26.7.0
Discovery Timeline
- 2026-09-01 - CVE-2026-84188 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84188
Vulnerability Analysis
The vulnerability resides in LibreNMS graph rendering logic. The application reads graph_descr.<graphtype> values from its configuration store and injects them directly into the HTML output produced by includes/html/pages/graphs.inc.php. Because the rendering path does not apply HTML entity encoding, any markup stored in these settings is interpreted by the browser as active content. An administrator with configuration access can persist a JavaScript payload that later runs under the origin of the LibreNMS web interface.
Exploitation requires an authenticated administrator to place the payload, and a second authenticated user to browse the affected graph type. The resulting script executes with the victim's session context. Consequences include session token theft, forced actions against the LibreNMS API, pivoting to monitored devices via stored credentials, and manipulation of monitoring dashboards viewed by operators.
Root Cause
The root cause is missing output encoding on trusted-but-user-controllable configuration values. LibreNMS treats graph_descr.<graphtype> entries as safe text, but the values originate from administrator input and are echoed into an HTML context without sanitization. The correct pattern is to encode with htmlspecialchars() or an equivalent escaper at render time, which the fix in 26.7.0 introduces.
Attack Vector
An attacker with administrator privileges submits a crafted graph_descr.<graphtype> value containing HTML or JavaScript through the LibreNMS settings interface. The payload is stored in the LibreNMS configuration. Any authenticated user who subsequently loads a page that renders that graph type triggers the payload. See the GitHub Security Advisory GHSA-7cj5-v4pp-v632 and the VulnCheck advisory for additional technical detail.
Detection Methods for CVE-2026-84188
Indicators of Compromise
- LibreNMS configuration entries under graph_descr.* containing <script>, onerror=, onload=, javascript:, or other HTML event handlers.
- Unexpected outbound requests from operator browsers to attacker-controlled domains after loading LibreNMS graph pages.
- Web server logs showing POST requests to LibreNMS settings endpoints modifying graph_descr keys from unusual admin sessions.
Detection Strategies
- Audit the LibreNMS config table or configuration store for graph_descr.<graphtype> values and inspect them for HTML tags or JavaScript syntax.
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script executions originating from LibreNMS pages.
- Correlate administrator configuration changes with subsequent anomalous browser activity on hosts that access the LibreNMS console.
Monitoring Recommendations
- Alert on modifications to LibreNMS configuration keys matching the graph_descr.* pattern.
- Monitor authenticated sessions for atypical API calls issued shortly after users open graph pages, which can indicate script-driven actions.
- Track browser process telemetry on operator workstations for script-initiated network connections to non-LibreNMS destinations.
How to Mitigate CVE-2026-84188
Immediate Actions Required
- Upgrade LibreNMS to version 26.7.0 or later on all instances.
- Review every graph_descr.<graphtype> configuration entry and remove any value containing HTML markup or scripting syntax.
- Rotate LibreNMS user session tokens and API keys if malicious values are found in stored settings.
- Restrict administrator accounts to trusted personnel and enforce multi-factor authentication on the LibreNMS console.
Patch Information
The LibreNMS maintainers fixed the issue in version 26.7.0 by properly escaping graph_descr.<graphtype> values before HTML output. Details are published in GitHub Security Advisory GHSA-7cj5-v4pp-v632. Operators running any release at or below 26.4.0 should treat the upgrade as the primary remediation.
Workarounds
- If immediate upgrade is not possible, manually clear all graph_descr.* configuration entries and block administrators from setting them until patching completes.
- Enforce a strict Content Security Policy that disallows inline scripts on LibreNMS pages to reduce payload execution.
- Place the LibreNMS web interface behind a reverse proxy that strips HTML tags from configuration POST bodies targeting graph_descr keys.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
