CVE-2026-84190: LibreNMS RCE Vulnerability

CVE-2026-84190 Overview

CVE-2026-84190 is a remote code execution vulnerability in LibreNMS versions before 26.5.0. The flaw resides in the AboutController, where the snmpget configuration parameter is passed directly to shell_exec() without validation. An authenticated administrator can modify the snmpget configuration to reference an arbitrary executable. Requesting the /about endpoint then triggers execution of the attacker-controlled binary under the LibreNMS service account. The issue is classified as [CWE-77] Improper Neutralization of Special Elements used in a Command.

Critical Impact
Authenticated administrators can achieve arbitrary command execution on the LibreNMS host, leading to full compromise of the network monitoring server and any credentials it stores.

Affected Products

LibreNMS versions prior to 26.5.0
LibreNMS AboutController component
Deployments exposing the /about endpoint to authenticated administrators

Discovery Timeline

2026-09-01 - CVE-2026-84190 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84190

Vulnerability Analysis

LibreNMS is an open-source network monitoring platform written in PHP. The AboutController gathers version and diagnostic information for display on the /about page. To report the installed SNMP tooling version, the controller reads the snmpget path from the application configuration and passes it to PHP's shell_exec() function. Because the configuration value is user-controllable through the administrative settings interface, the controller executes whatever binary an administrator supplies. The vulnerability enables an authenticated attacker with administrator privileges to run arbitrary operating system commands on the underlying host.

Root Cause

The root cause is missing input validation and unsafe command construction. The snmpget configuration parameter is treated as a trusted path but is written into a shell command string without sanitization or allowlisting. The controller does not verify that the configured value points to the legitimate snmpget binary or that the path resides in an approved directory. Any string an administrator supplies is executed by the system shell.

Attack Vector

An attacker who obtains administrator credentials, through phishing, credential reuse, or a chained authentication weakness, logs in to the LibreNMS web interface. The attacker navigates to the SNMP configuration section and sets the snmpget binary path to a malicious script or an existing system binary with attacker-supplied arguments. Visiting /about invokes shell_exec() with the poisoned value, executing the payload under the web server or LibreNMS service account. See the GitHub Security Advisory and the VulnCheck Advisory for LibreNMS for further technical detail.

Detection Methods for CVE-2026-84190

Indicators of Compromise

Modifications to the LibreNMS snmpget configuration value pointing to non-standard paths outside /usr/bin/ or /usr/local/bin/.
Unexpected child processes spawned by the PHP-FPM or web server user shortly after requests to /about.
Web server access logs showing repeated GET /about requests from administrative sessions.
New files, cron jobs, or SSH keys created under the LibreNMS service account.

Detection Strategies

Alert on writes to the LibreNMS configuration store or database rows containing the snmpget setting.
Baseline the expected snmpget binary path and flag deviations through file integrity monitoring.
Correlate /about HTTP requests with process execution telemetry to identify anomalous child processes of the web server.

Monitoring Recommendations

Ingest LibreNMS application logs and web access logs into a centralized analytics platform for behavioral analysis.
Monitor for shell interpreters (sh, bash, python, perl) spawned by the LibreNMS or web server process tree.
Review administrative login activity for unfamiliar source addresses or off-hours access.

How to Mitigate CVE-2026-84190

Immediate Actions Required

Upgrade LibreNMS to version 26.5.0 or later without delay.
Audit the current snmpget configuration value and reset it to the vendor-supplied default path.
Rotate credentials for all LibreNMS administrator accounts and any credentials stored within LibreNMS for monitored devices.
Review recent /about requests and administrator activity for signs of exploitation.

Patch Information

The LibreNMS project addressed the issue in release 26.5.0. The fix restricts how the snmpget configuration value is handled so it can no longer be passed unchecked to shell_exec(). Refer to the GitHub Security Advisory GHSA-jf24-8g2h-2wg7 for the authoritative patch details.

Workarounds

Restrict administrative access to LibreNMS to a small, audited group and enforce multi-factor authentication.
Place LibreNMS behind a reverse proxy or VPN so the web console is not reachable from untrusted networks.
Run LibreNMS under a low-privilege service account with restricted filesystem write access to limit post-exploitation impact.
Deploy mandatory access controls such as AppArmor or SELinux profiles that constrain which binaries the LibreNMS process may execute.

bash

# Configuration example: verify and reset the snmpget path after upgrade
grep -R "snmpget" /opt/librenms/config.php
which snmpget
# Ensure the configured path matches the system binary, e.g. /usr/bin/snmpget