CVE-2026-84189 Overview
CVE-2026-84189 is a stored cross-site scripting (XSS) vulnerability in LibreNMS through version 26.4.0. The network monitoring platform renders JSON fields returned by the admin-configurable Oxidized integration URL into the device showconfig page without applying htmlspecialchars(). Affected fields include name, ip, model, author, and commit message. An administrator who points oxidized.url at an attacker-controlled server, whether through server-side request forgery (SSRF) or misconfiguration, causes malicious JSON to be rendered in every user's browser. The vulnerability is tracked under [CWE-79] and fixed in LibreNMS 26.7.0.
Critical Impact
Persistent script injection affects every user who views any device's showconfig tab, enabling session theft, credential harvesting, and lateral pivoting inside the monitoring console.
Affected Products
- LibreNMS versions through 26.4.0
- LibreNMS releases prior to the 26.7.0 fix
- Deployments using the Oxidized configuration backup integration
Discovery Timeline
- 2026-09-01 - CVE-2026-84189 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-84189
Vulnerability Analysis
LibreNMS integrates with Oxidized to fetch device configuration histories over HTTP. The device showconfig view pulls JSON from the URL defined in the oxidized.url administrative setting. The Blade templates powering the view interpolate JSON string fields directly into HTML without escaping. Any script payload delivered through the name, ip, model, author, or commit message fields executes in the context of authenticated LibreNMS users.
Because the malicious response is served from an operator-controlled setting rather than user input, the payload persists across sessions and is rendered for every viewer of any device configuration tab. The result is a stored XSS reachable by all authenticated users, not only the administrator who altered the setting.
Root Cause
The root cause is missing output encoding on data returned from an external HTTP endpoint. The application treats the Oxidized JSON payload as trusted and omits htmlspecialchars() when rendering the fields. The fix in 26.7.0 applies proper HTML entity encoding to those fields before rendering.
Attack Vector
Exploitation requires an administrator to configure oxidized.url to point at an attacker-controlled host. This can occur through direct misconfiguration or through an SSRF primitive that redirects the integration to an attacker-hosted endpoint. The attacker's server returns crafted JSON containing script payloads in one of the vulnerable fields. When any authenticated user opens the showconfig tab for a device, the browser executes the injected script under the LibreNMS origin, exposing session cookies, CSRF tokens, and any authenticated API surface.
No synthetic exploit code is provided. See the GitHub Security Advisory GHSA-7gww-x7fh-jf9j and the VulnCheck Advisory for LibreNMS XSS for technical detail.
Detection Methods for CVE-2026-84189
Indicators of Compromise
- Unexpected values in the oxidized.url LibreNMS configuration setting pointing to hosts outside the documented Oxidized deployment
- Outbound HTTP requests from LibreNMS to unfamiliar external endpoints returning application/json with script tags in name, ip, model, author, or commit message fields
- Browser console errors or unexpected script execution originating from the LibreNMS /device/.../showconfig route
- New or modified LibreNMS user sessions and API tokens shortly after a showconfig view
Detection Strategies
- Inspect the LibreNMS configuration table and config.php for changes to oxidized.url and alert on modifications
- Proxy or log outbound HTTP requests from the LibreNMS host and match responses against JSON payloads containing <script, onerror=, or javascript: substrings
- Review web server access logs for repeated hits to showconfig immediately followed by authentication or API events on the same session
Monitoring Recommendations
- Enable audit logging for administrative configuration changes in LibreNMS and forward events to a centralized SIEM
- Restrict egress from the LibreNMS server to the known Oxidized endpoint and alert on deviations
- Deploy a Content Security Policy that blocks inline scripts on LibreNMS pages to raise the cost of script execution
How to Mitigate CVE-2026-84189
Immediate Actions Required
- Upgrade LibreNMS to version 26.7.0 or later, which applies htmlspecialchars() to the affected Oxidized JSON fields
- Audit the current oxidized.url value and confirm it references only the internal Oxidized service
- Rotate LibreNMS session tokens and API keys if the showconfig view has been accessed since a suspicious configuration change
- Restrict administrative access to LibreNMS to a minimal set of accounts protected with multi-factor authentication
Patch Information
The vulnerability is fixed in LibreNMS 26.7.0. The patch adds HTML entity encoding to the name, ip, model, author, and commit message fields rendered on the device showconfig page. Refer to GitHub Security Advisory GHSA-7gww-x7fh-jf9j for commit-level detail.
Workarounds
- Disable the Oxidized integration until the upgrade is complete by unsetting oxidized.enabled and oxidized.url
- Apply network egress filtering so the LibreNMS host can reach only the trusted internal Oxidized instance
- Remove or hide the showconfig tab from non-administrative roles through role-based access control
# Configuration example: disable the Oxidized integration until patched
php /opt/librenms/lnms config:set oxidized.enabled false
php /opt/librenms/lnms config:set oxidized.url ""
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
