CVE-2026-84192 Overview
CVE-2026-84192 is a stored cross-site scripting vulnerability in LibreNMS versions before 26.3.1. Legacy PHP templates render SNMP-sourced and syslog-sourced data without HTML escaping. An attacker who controls a monitored network device can inject JavaScript through SNMP interface descriptions or syslog program fields. The injected payload executes in the browser session of any authenticated user who views the affected pages.
Critical Impact
Attackers with control of a monitored device can hijack authenticated LibreNMS operator sessions and execute actions in the monitoring platform.
Affected Products
- LibreNMS versions prior to 26.3.1
- Deployments ingesting SNMP interface metadata from untrusted devices
- Deployments ingesting syslog messages from untrusted network sources
Discovery Timeline
- 2026-09-01 - CVE-2026-84192 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-84192
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. LibreNMS collects operational telemetry from monitored infrastructure using SNMP polling and syslog reception. Legacy PHP view templates render this ingested data directly into HTML pages without applying output encoding.
When an authenticated operator views a device details page, ports listing, or syslog viewer, the browser parses attacker-controlled markup as HTML. Injected JavaScript then runs with the operator's session context. This enables session token theft, unauthorized configuration changes, and lateral pivoting through the monitoring platform.
Exploitation requires user interaction, since an authenticated user must open the affected view to trigger execution. The attacker does not need credentials to LibreNMS itself, only control of a device that LibreNMS monitors.
Root Cause
The root cause is missing output encoding in legacy PHP templates. Fields such as SNMP ifDescr, ifAlias, and syslog program values are written into HTML contexts without invoking htmlspecialchars() or an equivalent escaping routine. LibreNMS treats SNMP and syslog data as trusted operational metadata, but these fields are attacker-controllable on any compromised or rogue device.
Attack Vector
An attacker configures a rogue or compromised device that LibreNMS polls. The attacker sets an SNMP interface description or emits a syslog message containing an HTML <script> payload or event handler attribute. LibreNMS stores the field verbatim. When an operator opens the device view, ports page, or syslog log, the browser executes the payload. The VulnCheck Advisory: LibreNMS XSS and GitHub Security Advisory GHSA-7w8c-qgxg-m7jx document the affected fields and templates.
Detection Methods for CVE-2026-84192
Indicators of Compromise
- SNMP ifDescr or ifAlias values containing <script>, onerror=, onload=, or javascript: substrings.
- Syslog messages with program or tag fields containing HTML markup or JavaScript event handlers.
- Unexpected outbound requests from operator browsers to attacker-controlled domains shortly after loading LibreNMS device pages.
Detection Strategies
- Query the LibreNMS database for interface and syslog rows where text fields contain <, >, or javascript:.
- Inspect HTTP responses served by LibreNMS for unescaped angle brackets inside device metadata fields.
- Correlate new or recently added devices with anomalous SNMP string values that deviate from vendor defaults.
Monitoring Recommendations
- Enable Content Security Policy reporting on the LibreNMS host to surface inline script violations.
- Log and alert on administrative actions performed immediately after operators view device or syslog pages.
- Monitor changes to LibreNMS user accounts, API tokens, and alert transports that could indicate post-XSS abuse.
How to Mitigate CVE-2026-84192
Immediate Actions Required
- Upgrade LibreNMS to version 26.3.1 or later on all instances.
- Rotate LibreNMS user sessions and API tokens after upgrading to invalidate any credentials exposed through prior exploitation.
- Audit the device inventory for untrusted or unmanaged devices and remove those that should not be polled.
Patch Information
The LibreNMS project addressed the issue in release 26.3.1 by adding output encoding to the legacy templates that render SNMP and syslog fields. Details are published in GitHub Security Advisory GHSA-7w8c-qgxg-m7jx.
Workarounds
- Restrict LibreNMS web access to trusted operator networks using a reverse proxy or firewall ACLs.
- Deploy a strict Content Security Policy that disallows inline scripts in front of the LibreNMS UI.
- Segment SNMP and syslog ingestion so that untrusted devices cannot reach the LibreNMS poller until patching is complete.
# Upgrade LibreNMS via the built-in daily updater
cd /opt/librenms
sudo -u librenms ./daily.sh
# Verify the running version is 26.3.1 or later
php artisan --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
