PT-2026-20788 · Librenms · Librenms

Awoffsec · Published 2026-02-18 · Updated 2026-02-20 · CVE-2026-26991

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions LibreNMS versions 26.1.1 and below

Description LibreNMS, an auto-discovering PHP/MySQL/SNMP based network monitoring tool, contains a Stored Cross-Site Scripting (XSS) issue. The device group name is not sanitized, allowing attackers with admin privileges to inject malicious scripts. The vulnerability occurs when adding a device group via an HTTP POST request to the '/device-groups' endpoint, where the attacker-controlled input is stored in the name parameter. This unsanitized input is then displayed, potentially executing the injected script when a user interacts with the device group entry, such as clicking the Delete button. The issue is present because the device's name is used in the Delete button functionality without proper sanitization for XSS-related characters or strings. A proof-of-concept demonstrates that an attacker can leak a user's cookies by crafting a malicious payload and sending an HTTP request to an attacker-controlled server.

Recommendations Update to version 26.2.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-26991

GHSA-5PQF-54QP-32WX

Affected Products

Librenms

References · 11

• 🔥 https://github.com/librenms/librenms/security/advisories/GHSA-5pqf-54qp-32wx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26991.json · Exploit
• https://github.com/librenms/librenms/commit/64b31da444369213eb4559ec1c304ebfaa0ba12c · Patch
• https://osv.dev/vulnerability/GHSA-5pqf-54qp-32wx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26991 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26991 · Security Note
• https://github.com/librenms/librenms · Note
• https://github.com/librenms/librenms/releases/tag/26.2.0 · Note
• https://github.com/librenms/librenms/pull/19041 · Note
• https://t.me/CVEtracker/45235 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2024845218969715093 · Twitter Post