Stored Cross-Site Scripting in LibreNMS Network Monitoring Tool

CVE-2026-26992

What is CVE-2026-26992?

LibreNMS, a widely-used network monitoring tool built on PHP/MySQL/SNMP, is vulnerable to Stored Cross-Site Scripting (XSS) in versions 26.1.1 and earlier. This vulnerability arises from insufficient sanitization of the port group name, allowing attackers with administrative privileges to execute malicious scripts. When a new port group is created, an HTTP POST request processes the name parameter without proper filtering, which can lead to harmful content being rendered to users. This security concern has been addressed in version 26.2.0, urging all users to update for enhanced protection.

References