CVE-2026-84191: LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields
LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrfname, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary JavaScript through SNMP responses that executes in the browser of any user viewing VRF-related pages.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
LibreNMS installations before 26.5.0 are exposed when they poll monitored devices that provide attacker-controlled values in VRF-related SNMP fields. Any user who views the affected VRF display pages may have injected JavaScript execute in their browser.
What does an attacker need to exploit it?
An attacker needs control of a monitored network device, or otherwise needs to control its SNMP responses. Exploitation also requires a user to visit a VRF-related page that renders the stored values.
Which SNMP data fields should be investigated?
Review VRF-related SNMP data for unexpected or untrusted content in mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher. These are the fields identified as being rendered without sanitization.
How can exposure be reduced if an upgrade is not immediately possible?
Limit monitoring to trusted devices and prevent untrusted parties from controlling monitored-device SNMP responses. Restrict access to VRF-related LibreNMS pages to reduce the chance that users render malicious stored values.