PT-2026-32330 · Librenms · Librenms

Prjblk · Published 2026-04-13 · Updated 2026-05-18 · CVE-2026-2728

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.3.0

Description An authenticated Cross-site Scripting issue exists on the 'showconfig' page. An attacker with administrative privileges can execute scripts that target other users who access the same page.

Recommendations Update to version 26.3.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-2728

GHSA-5GM9-622F-QCG5

GHSA-RP7W-624X-95QV

Affected Products

Librenms

References · 9

• 🔥 https://projectblack.io/blog/librenms-authenticated-rce-and-xss/#xss-on-showconfig-page-2630 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2728 · Security Note
• https://osv.dev/vulnerability/GHSA-5gm9-622f-qcg5 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rp7w-624x-95qv · Vendor Advisory
• https://github.com/librenms/librenms/releases/tag/26.3.0 · Note
• https://github.com/librenms/librenms/security/advisories/GHSA-5gm9-622f-qcg5 · Note
• https://github.com/librenms/librenms · Note
• https://twitter.com/VulmonFeeds/status/2043680974009929928 · Twitter Post
• https://twitter.com/CVEnew/status/2043733055320535089 · Twitter Post