RCE in Librenms

CVE-2026-6204

LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires administrative privileges. Exploitatio…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.000 (0.8th percentile) — read the EPSS interpretation.

Affected products

Librenms — versions 0

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

github.com/librenms/librenms/security/advisories/GHSA-pr3g-phhr-h8fh (vendor-advisory)
projectblack.io/blog/librenms-authenticated-rce-and-xss/ (exploit)