CVE-2026-84191 Overview
CVE-2026-84191 is a stored cross-site scripting vulnerability in LibreNMS network monitoring software before version 26.5.0. The flaw exists in Virtual Routing and Forwarding (VRF) display pages, where the mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher fields are rendered without sanitization. These values originate from Simple Network Management Protocol (SNMP) polling of monitored devices. An attacker who controls a monitored network device can embed JavaScript payloads in SNMP responses. Those payloads execute in the browser of any authenticated user viewing VRF-related pages. The vulnerability is tracked under [CWE-79] and affects LibreNMS installations that monitor devices via SNMP.
Critical Impact
Stored JavaScript executes in authenticated LibreNMS user sessions, enabling session theft, credential harvesting, and pivoting into the monitoring platform.
Affected Products
- LibreNMS versions prior to 26.5.0
- Deployments polling MPLS/VRF-enabled network devices via SNMP
- Any LibreNMS instance rendering VRF pages to authenticated users
Discovery Timeline
- 2026-09-01 - CVE-2026-84191 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-84191
Vulnerability Analysis
LibreNMS collects VRF data from monitored routers and switches through SNMP polling of MPLS-VPN MIB objects. The retrieved values populate the vrfs database table and are subsequently rendered in the web interface. The affected fields (mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher) are inserted into HTML output without contextual encoding. This allows an attacker to inject script tags or event handlers that execute within the LibreNMS application origin. Because the malicious data is persisted after each poll cycle, the injection behaves as a stored XSS rather than a reflected variant. Exploitation requires user interaction, since a LibreNMS operator must load a VRF page for the payload to fire.
Root Cause
The root cause is missing output encoding on SNMP-sourced string fields. LibreNMS treats data returned from managed devices as trusted, but SNMP responses are attacker-influenceable when a device is compromised or when an attacker introduces a rogue device into the monitored inventory. Without HTML entity encoding on the VRF template variables, arbitrary markup is emitted verbatim to the Document Object Model.
Attack Vector
Exploitation requires the attacker to control an SNMP-reachable device polled by LibreNMS. The attacker configures VRF descriptions, names, or route distinguishers containing JavaScript payloads. When LibreNMS next polls the device, the malicious strings are stored. Any authenticated user visiting the affected VRF page executes the payload in their browser session. Consequences include session cookie exfiltration, forced administrative actions via the LibreNMS API, and lateral movement using the operator's credentials. Refer to the GitHub Security Advisory and the VulnCheck XSS Advisory for additional technical detail.
Detection Methods for CVE-2026-84191
Indicators of Compromise
- VRF records in the LibreNMS database containing <script>, onerror=, onload=, or javascript: substrings in vrf_name, mplsVpnVrfDescription, or mplsVpnVrfRouteDistinguisher columns.
- Unexpected outbound requests from operator browsers to attacker-controlled domains after visiting VRF pages.
- SNMP polling logs showing VRF field values with HTML markup or unusually long non-ASCII strings.
Detection Strategies
- Query the LibreNMS vrfs table for angle brackets, quotes, or JavaScript URI schemes in text columns.
- Inspect HTTP responses served by LibreNMS VRF pages for unencoded HTML originating from device-sourced fields.
- Correlate SNMP write activity or device configuration changes with subsequent anomalous browser telemetry from monitoring staff.
Monitoring Recommendations
- Enable Content Security Policy reporting on the LibreNMS front-end to surface inline script violations.
- Log and alert on administrative API calls initiated from operator sessions immediately after VRF page visits.
- Track SNMP configuration changes on managed devices, especially edits to VRF descriptions and route distinguishers.
How to Mitigate CVE-2026-84191
Immediate Actions Required
- Upgrade LibreNMS to version 26.5.0 or later, which introduces sanitization on the affected VRF fields.
- Audit the vrfs database table and purge any entries containing HTML or JavaScript payloads.
- Restrict SNMP write access on managed devices and rotate SNMP community strings on any device suspected of tampering.
Patch Information
The LibreNMS maintainers addressed the issue in release 26.5.0. The fix applies output encoding to mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher before rendering. See the GitHub Security Advisory GHSA-g993-wffj-m3gv for commit references and upgrade guidance.
Workarounds
- Limit LibreNMS web console access to trusted network segments and enforce multi-factor authentication for operators.
- Temporarily disable VRF discovery on untrusted device groups until the upgrade is applied.
- Deploy a Web Application Firewall rule to strip HTML tags from LibreNMS responses containing VRF field markers.
# Configuration example: verify installed LibreNMS version and upgrade
cd /opt/librenms
./daily.sh
php artisan --version
# Confirm version is 26.5.0 or later before returning VRF pages to production users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
