CVE-2026-26987: LibreNMS affected by reflected XSS via email field
Summary reflected xss via email field
Details 1. visit http://127.0.0.1/settings/alerting/email 2. in the email address input but this payload <img src=1 onerror=alert(document.cookie)> 3. notice the alert PoC - video attached with the report https://github.com/user-attachments/assets/c1b443f5-85c6-4545-b04f-def06d82b42e
Impact can lead to ATO
Other sources
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email field. This issue has been fixed in version 26.2.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26987?
CVE-2026-26987 is classified as a reflected XSS vulnerability that can potentially lead to session hijacking or data theft.
How do I fix CVE-2026-26987?
To fix CVE-2026-26987, upgrade LibreNMS to version 26.2.0 or later.
Who is affected by CVE-2026-26987?
CVE-2026-26987 affects all versions of LibreNMS prior to 26.2.0, specifically those with a vulnerable email field.
What is reflected XSS in the context of CVE-2026-26987?
Reflected XSS in CVE-2026-26987 allows an attacker to execute malicious scripts in the context of the victim's browser by sending a specially crafted email input.
What are the potential impacts of CVE-2026-26987?
The potential impacts of CVE-2026-26987 include the exposure of sensitive data, such as cookies and user sessions, which can be exploited by attackers.