CVE-2026-84194: LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname
LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery. When libvirt support is enabled (enablelibvirt=true), the device hostname ($this->getDevice()->hostname) is concatenated into shell commands (ssh, virsh list/dumpxml/domstate) in VminfoLibvirt.php and passed to exec() without escapeshellarg() or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands, leading to remote code execution in the discovery worker context.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LibreNMSto a version that resolves this vulnerability.Fixed in 26.4.0 - Configuration
If you cannot immediately upgrade to LibreNMS 26.4.0, disable libvirt support by setting enable_libvirt=false to prevent hostname-based command injection in libvirt discovery.
LibreNMS libvirt discovery enable_libvirt = false
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated LibreNMS administrator can exploit it by setting a crafted device hostname. Exploitation requires libvirt support to be enabled with enable_libvirt=true.
What systems are exposed by default?
Only deployments with libvirt discovery enabled are described as affected. The provided information does not state whether enable_libvirt is enabled by default.
What is the impact of successful exploitation?
A successful exploit allows arbitrary OS command execution in the LibreNMS discovery worker context.
How can I determine whether my deployment is affected?
Check whether LibreNMS is running a version from 23.10.0 up to, but not including, 26.2.0, and whether enable_libvirt=true is configured. Also review whether administrative users can create or modify device hostnames.
What can be done if upgrading is not immediately possible?
Disable libvirt support by setting enable_libvirt to false, and restrict administrator access to trusted users. This removes the stated vulnerable libvirt discovery path until an update can be applied.