CVE-2026-84193: LibreNMS Stored XSS Vulnerability

CVE-2026-84193 Overview

CVE-2026-84193 is a stored cross-site scripting (XSS) vulnerability affecting LibreNMS through version 26.2.0. The flaw resides in legacy PHP template pages that render SNMP-sourced data fields without proper output encoding. Affected fields include BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management privileges, or network access sufficient to enroll a rogue SNMP device, can inject JavaScript payloads. The payloads execute in an administrator's browser when they view the affected routing and device pages. This enables credential theft and CSRF token exfiltration against the LibreNMS interface. The issue is tracked under [CWE-79].

Critical Impact
Successful exploitation lets attackers execute arbitrary JavaScript in administrator sessions, exfiltrate CSRF tokens, and hijack LibreNMS accounts through admin-viewed device pages.

Affected Products

LibreNMS versions up to and including 26.2.0
Legacy PHP template pages rendering SNMP-sourced fields
Deployments accepting SNMP data from untrusted or attacker-controlled devices

Discovery Timeline

2026-09-01 - CVE-2026-84193 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84193

Vulnerability Analysis

LibreNMS ingests operational data from monitored devices using the Simple Network Management Protocol (SNMP). Values retrieved from devices, such as BGP peer descriptions, VRF names, running process names, and SLA tag strings, are stored in the LibreNMS database. Legacy PHP templates then render these values into administrative HTML pages without sufficient escaping. Because SNMP data is attacker-influenced when a rogue or compromised device is present, malicious HTML and JavaScript reach the DOM intact. When an administrator navigates to an affected routing or device page, the browser executes the injected script under the LibreNMS origin. This produces a stored XSS condition consistent with [CWE-79].

Root Cause

The root cause is missing or incorrect output encoding in legacy PHP view templates. LibreNMS treats SNMP-supplied strings as trusted rendering content rather than untrusted user input. No contextual HTML entity encoding is applied before insertion into the response body.

Attack Vector

Exploitation requires either device management access to modify an existing SNMP configuration, or network access to enroll a rogue SNMP device that LibreNMS will poll. The attacker embeds a JavaScript payload inside an SNMP-exposed field such as a BGP peer description or SLA tag. The payload persists in the LibreNMS database and executes when an authenticated administrator views the affected page. User interaction from the admin is required, which is reflected in the CVSS 4.0 vector.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-v5jp-f342-234h and the VulnCheck Advisory on LibreNMS XSS for technical detail.

Detection Methods for CVE-2026-84193

Indicators of Compromise

SNMP-sourced fields containing HTML tags, <script> blocks, on*= event handlers, or javascript: URIs stored in the LibreNMS database.
Unexpected outbound requests from admin browsers to attacker-controlled domains shortly after viewing device or routing pages.
New or unrecognized SNMP devices added to LibreNMS without a corresponding change ticket.
Anomalous BGP peer descriptions, VRF names, or SLA tags containing non-printable or markup characters.

Detection Strategies

Query the LibreNMS database for stored SNMP fields matching regex patterns for HTML or JavaScript syntax.
Review LibreNMS audit logs for device enrollment events originating from unexpected source IP ranges.
Inspect rendered HTML on /bgp, /device, /routing, and SLA pages for content that fails a Content Security Policy (CSP) baseline.
Correlate administrator session activity with outbound DNS or HTTP requests to unknown destinations.

Monitoring Recommendations

Alert on SNMP polling responses containing angle brackets, quotes, or JavaScript keywords in string OIDs.
Monitor administrative sessions for unexpected fetch or XHR calls to external hosts.
Track creation of new SNMP device entries and require approval workflows for enrollment.

How to Mitigate CVE-2026-84193

Immediate Actions Required

Upgrade LibreNMS to a version later than 26.2.0 that addresses the advisory GHSA-v5jp-f342-234h.
Restrict device management permissions to a minimal set of trusted operator accounts.
Segment the SNMP polling network so LibreNMS only polls approved devices from authenticated network segments.
Audit existing SNMP-sourced fields for stored payloads and sanitize or remove suspicious entries.

Patch Information

Apply the fix referenced in the GitHub Security Advisory GHSA-v5jp-f342-234h. The advisory identifies the corrected LibreNMS release and the templates updated to apply proper HTML entity encoding on SNMP-sourced fields.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts on the LibreNMS web interface.
Place LibreNMS behind a web application firewall (WAF) with rules that block HTML and script tokens in rendered device fields.
Limit SNMP write and enrollment capability to isolated management VLANs with access control lists.
Require administrators to use browser profiles dedicated to LibreNMS to reduce credential exposure from XSS.

bash

# Configuration example
# Example nginx header to enforce a restrictive CSP in front of LibreNMS
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;