CVE-2026-6204: OS Command Injection
LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires administrative privileges. Exploitation could result in compromise of the underlying web server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LibreNMSto a version that resolves this vulnerability.Fixed in 26.3.0 - Compensating control
Because successful exploitation requires administrative privileges, restrict administrative access to LibreNMS (e.g., limit admin accounts and ensure only trusted users can access/modify configuration and the Netcommand feature).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6204?
CVE-2026-6204 is classified as a critical vulnerability due to the potential for authenticated remote code execution.
How do I fix CVE-2026-6204?
To fix CVE-2026-6204, upgrade LibreNMS to version 26.3.0 or later.
What are the consequences of exploiting CVE-2026-6204?
Exploitation of CVE-2026-6204 could lead to complete compromise of the underlying web server.
Who is affected by CVE-2026-6204?
CVE-2026-6204 affects all versions of LibreNMS prior to 26.3.0.
What features are exploited in CVE-2026-6204?
CVE-2026-6204 exploits the Binary Locations config and the Netcommand feature in LibreNMS.