CVE-2026-84194 Overview
CVE-2026-84194 is an authenticated operating system command injection vulnerability in LibreNMS, an open-source network monitoring platform. The flaw resides in the libvirt discovery module (VminfoLibvirt.php) and affects versions >= 23.10.0 and < 26.2.0. LibreNMS released a fix in version 26.4.0. Exploitation requires administrative access and libvirt support enabled (enable_libvirt=true). An attacker who can set a device hostname can inject arbitrary shell commands into ssh, virsh list, virsh dumpxml, and virsh domstate invocations. Successful exploitation yields remote code execution in the context of the discovery worker.
Critical Impact
Authenticated administrators can achieve remote code execution on the LibreNMS discovery worker by crafting a malicious device hostname, compromising the monitoring server and any credentials it stores.
Affected Products
- LibreNMS >= 23.10.0 and < 26.2.0
- LibreNMS deployments with enable_libvirt=true
- Fixed in LibreNMS 26.4.0
Discovery Timeline
- 2026-09-01 - CVE-2026-84194 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-84194
Vulnerability Analysis
The vulnerability is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command. LibreNMS builds shell command strings inside VminfoLibvirt.php by concatenating the device hostname returned from $this->getDevice()->hostname directly into ssh and virsh invocations. Those strings are passed to PHP's exec() function without escapeshellarg() or the argument separator --.
Because hostnames are attacker-controlled through the admin UI, an authenticated administrator can store shell metacharacters in the hostname field. Each time the discovery worker runs libvirt collection against the device, the injected payload executes on the LibreNMS host. The discovery worker typically runs with sufficient privileges to read monitoring credentials, SNMP community strings, and SSH keys used to poll infrastructure.
Root Cause
The root cause is missing input sanitization when composing shell commands. The affected code paths in VminfoLibvirt.php invoke virsh list, virsh dumpxml, and virsh domstate over SSH, interpolating the hostname string into the command line. Because PHP's exec() invokes /bin/sh -c on the composed string, any shell metacharacters (backticks, $(), ;, &&, |) trigger command substitution or chaining.
Attack Vector
Exploitation requires an authenticated administrator account and a LibreNMS instance configured with libvirt discovery enabled. The attacker creates or edits a device entry, setting the hostname field to a value containing shell metacharacters and a command payload. When the scheduled discovery worker processes the device, the payload runs in the discovery worker context. See the GitHub Security Advisory GHSA-wff2-9gjr-95f3 and the VulnCheck Security Advisory for technical details.
Detection Methods for CVE-2026-84194
Indicators of Compromise
- Device records with hostname fields containing shell metacharacters such as backticks, $(), ;, |, or &&.
- Unexpected child processes spawned by the LibreNMS discovery worker or PHP-FPM user, particularly sh -c, bash, curl, wget, nc, or python.
- Outbound network connections from the LibreNMS server to unfamiliar hosts during discovery cycles.
- Modifications to LibreNMS configuration, cron entries, or SSH authorized_keys on the monitoring server.
Detection Strategies
- Audit the LibreNMS devices table for hostnames that fail strict RFC 1123 validation.
- Monitor process ancestry where the LibreNMS worker or php process spawns shell utilities not associated with normal virsh or ssh operation.
- Correlate discovery job execution timestamps with anomalous outbound connections or new local user activity.
Monitoring Recommendations
- Enable command-line auditing (auditd or equivalent) on the LibreNMS host and alert on suspicious child processes of the discovery worker.
- Ship LibreNMS application logs and OS process telemetry to a centralized platform for correlation and retention.
- Review admin account activity logs for unexpected device creation or hostname edits.
How to Mitigate CVE-2026-84194
Immediate Actions Required
- Upgrade LibreNMS to version 26.4.0 or later, which fixes the vulnerable command construction in VminfoLibvirt.php.
- If upgrading is not immediately possible, set enable_libvirt=false to disable the affected discovery module.
- Review all device hostnames for shell metacharacters and remove or normalize any suspicious entries.
- Rotate credentials (SNMP, SSH keys, API tokens) stored on the LibreNMS server if compromise is suspected.
Patch Information
The LibreNMS project addressed the vulnerability in version 26.4.0. The fix escapes hostname input before passing it to exec() and enforces argument separation for ssh and virsh invocations. Refer to GHSA-wff2-9gjr-95f3 for the upstream advisory and patch commits.
Workarounds
- Disable libvirt discovery by setting enable_libvirt=false in the LibreNMS configuration until the patch is applied.
- Restrict administrative access to LibreNMS using strong authentication and role-based access controls, since exploitation requires admin privileges.
- Enforce hostname validation at the reverse proxy or application layer to reject inputs containing shell metacharacters.
- Run the LibreNMS discovery worker under a least-privileged account with no access to secrets outside its scope.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
