CVE-2026-26992 Details
Description
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the port group name is not sanitized, allowing attackers with admin privileges to perform Stored Cross-Site Scripting (XSS) attacks. When a user adds a port group, an HTTP POST request is sent to the Request-URI "/port-groups". The name of the newly created port group is stored in the value of the name parameter. After the port group is created, the entry is displayed along with relevant buttons such as Edit and Delete. This issue has been fixed in version 26.2.0.
A stored cross-site scripting vulnerability has been identified in LibreNMS versions through 26.1.1. The issue arises in the port group management feature, where the name of a newly created port group is not properly sanitized before being displayed. This flaw allows authenticated users with admin privileges to inject malicious scripts that are executed when the port group is accessed. The vulnerability is triggered by sending an HTTP POST request to the '/port-groups' endpoint with a crafted name parameter. The injected script is then executed when the corresponding port group is deleted, potentially leading to cookie theft or other malicious actions.
Users can upgrade to LibreNMS version 26.2.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/librenms/librenms/commit/882fe6f90ea504a3732f83caf89bba7850a5699f | [email protected] | Patch |
| https://github.com/librenms/librenms/pull/19042 | [email protected] | Issue Tracking |
| https://github.com/librenms/librenms/releases/tag/26.2.0 | [email protected] | ProductRelease Notes |
| https://github.com/librenms/librenms/security/advisories/GHSA-93fx-g747-695x | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| librenms librenms | < 26.2.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 20, 2026 | Initial Analysis | [email protected] |
| Feb 20, 2026 | New CVE Received | [email protected] |