CVE-2026-84193: LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enroll a rogue SNMP device can inject malicious JavaScript that executes when admins view affected routing and device pages, enabling credential theft and CSRF token exfiltration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LibreNMSto a version that resolves this vulnerability.Fixed in 26.2.0 - Compensating control
If you have enrollable SNMP discovery/device management, restrict/enforce access so attackers cannot enroll a rogue SNMP device (limit SNMP enrollment/discovery and management access to trusted networks/admins only).
Event History
Frequently Asked Questions
Who can inject the malicious data?
An attacker needs device management access, or network access sufficient to enroll a rogue SNMP device. The injected values can include BGP peer descriptions, VRF names, process information, and SLA tags.
Which users are at risk when the payload is triggered?
Administrators who view affected routing or device pages can trigger the stored JavaScript. Successful execution can enable theft of credentials and exfiltration of CSRF tokens.
How can I determine whether an instance may be affected?
Instances running LibreNMS through 26.2.0 may be affected if they use the legacy PHP template pages that render SNMP-sourced fields. Review SNMP-discovered values, especially BGP peer descriptions, VRF names, process information, and SLA tags, for unexpected script-like content.