CVE-2026-84189 LibreNMS before 26.7.0 Stored XSS via Oxidized API
Attackers can inject malicious scripts into LibreNMS via Oxidized API responses, affecting all users viewing device configurations.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-84189?
CVE-2026-84189 is a critical cross-site scripting vulnerability in librenms, published on 1 Sep 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the device showconfig page without applying htmlspecialchars(). An administrator who points the Oxidized URL at an attacker-controlled server (SSRF) can cause it to return malicious JSON, resulting in stored/persistent cross-site scripting affecting all users who view any device's showconfig tab. Fixed in 26.7.0.
Weakness: CWE-79
Which versions are affected by CVE-2026-84189?
2 open source packages ship an affected version, including librenms/librenms.
| Package | Affected | Fixed in |
|---|---|---|
librenms/librenms Packagist | All versions | 26.7.0 |
librenms/librenms Packagist | All versions | 26.7.0 |
How do I fix CVE-2026-84189?
Upgrade librenms/librenms to 26.7.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-84189 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84189 exists.
Sources
Also known as GHSA-7gww-x7fh-jf9j, GHSA-r436-6p4j-frwf.