OS Command Injection in LibreNMS by The LibreNMS Community

CVE-2026-84194

What is CVE-2026-84194?

An OS command injection vulnerability exists in LibreNMS versions from 23.10.0 up to but not including 26.2.0, specifically when libvirt support is activated. The issue arises in the VminfoLibvirt.php file, where device hostnames are improperly concatenated into shell commands and executed without proper argument handling. This flaw allows authenticated administrators to manipulate device hostnames, potentially leading to arbitrary command execution on the server. The vulnerability has been addressed in version 26.4.0, and remediation is strongly advised.

References