PT-2026-20789 · Librenms · Librenms

Awoffsec · Published 2026-02-18 · Updated 2026-02-20 · CVE-2026-26992

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions LibreNMS versions 26.1.1 and below

Description LibreNMS is a network monitoring tool. A stored cross-site scripting (XSS) issue exists due to insufficient sanitization of the port group name. An attacker with administrator privileges can inject malicious code through the name parameter in an HTTP POST request to the /port-groups API endpoint. The unsanitized input is then displayed, potentially executing the injected script when the delete button is rendered. The vulnerable parameter is name. The issue occurs when creating a new port group.

Recommendations LibreNMS versions 26.1.1 and below should be updated to version 26.2.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-26992

GHSA-93FX-G747-695X

Affected Products

Librenms

References · 11

• 🔥 https://github.com/librenms/librenms/security/advisories/GHSA-93fx-g747-695x · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26992.json · Exploit
• https://github.com/librenms/librenms/commit/882fe6f90ea504a3732f83caf89bba7850a5699f · Patch
• https://osv.dev/vulnerability/CVE-2026-26992 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26992 · Security Note
• https://osv.dev/vulnerability/GHSA-93fx-g747-695x · Vendor Advisory
• https://github.com/librenms/librenms · Note
• https://github.com/librenms/librenms/releases/tag/26.2.0 · Note
• https://github.com/librenms/librenms/pull/19042 · Note
• https://t.me/CVEtracker/45236 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2024842659123065267 · Twitter Post