Stored Cross-Site Scripting in LibreNMS Affects Network Management
CVE-2026-109355

5.3MEDIUM

Key Information:

Vendor

Librenms

Status
Librenms
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109355?

LibreNMS prior to version 26.9.0 is subject to a stored cross-site scripting vulnerability within the get_oxidized_nodes_list() function. This flaw allows attackers to exploit the Oxidized API and any device's SNMP sysName by injecting malicious scripts. These scripts execute in the browsers of users accessing the Tools Oxidized page, potentially leading to unauthorized actions or data exposure.

Affected Version(s)

librenms 0 < 26.9.0

librenms 26.9.0

References

https://github.com/librenms/librenms/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/librenms-before-26.9...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.