PT-2026-20904 · Librenms · Librenms

Quirmz · Published 2026-02-18 · Updated 2026-02-20 · CVE-2026-26989

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LibreNMS versions 25.12.0 and below

Description LibreNMS, an auto-discovering PHP/MySQL/SNMP based network monitoring tool, contains a Stored Cross-Site Scripting (XSS) issue in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This allows for the execution of arbitrary code within a user's browser session.

Recommendations Update to version 26.2.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-26989

GHSA-6XMX-XR9P-58P7

Affected Products

Librenms

References · 12

• 🔥 https://github.com/librenms/librenms/security/advisories/GHSA-6xmx-xr9p-58p7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26989.json · Exploit
• https://github.com/librenms/librenms/commit/087608cf9f851189847cb8e8e5ad002e59170c58 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-26989 · Security Note
• https://osv.dev/vulnerability/GHSA-6xmx-xr9p-58p7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26989 · Vendor Advisory
• https://github.com/librenms/librenms · Note
• https://github.com/librenms/librenms/pull/19039 · Note
• https://github.com/librenms/librenms/releases/tag/26.2.0 · Note
• https://t.me/CVEtracker/45230 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2024691642226049145 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1r91qgc/resumen_diario_de_vulnerabilidades_19022026 · Reddit Post