CVE-2026-84192: LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog program fields that executes when authenticated users view affected pages.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
LibreNMS installations running a version before 26.3.1 are exposed when they display affected SNMP-sourced interface descriptions or syslog-sourced program fields. The payload executes in the browser of authenticated users who view the affected pages.
What does an attacker need to exploit it?
An attacker needs control over a monitored network device so they can place JavaScript in an SNMP interface description or a syslog program field. Exploitation also requires an authenticated LibreNMS user to view a page that renders the injected data.
Is user interaction required?
Yes. The injected script executes when an authenticated user views an affected LibreNMS page; the attack vector is network-based and does not require the attacker to have LibreNMS credentials.
What version addresses the issue?
Upgrade LibreNMS to version 26.3.1 or later. The issue affects versions before 26.3.1.