XSS in Librenms

CVE-2026-84193

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enroll a rogue SNMP device can inject malicious JavaScript that executes when admins view affected routing and device pages, enabling credential theft and CSRF token exfiltration.

Vulnerability class: XSS (Cross-Site Scripting)

Published 2026-09-01 · last modified 2026-09-08.

EPSS exploit prediction

EPSS: 0.003 (26.9th percentile), scored 2026-10-17.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 26.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.001

Affected products

Librenms

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

github.com/librenms/librenms/security/advisories/GHSA-v5jp-f342-234h (vendor-advisory)
www.vulncheck.com/advisories/librenms-through-26.2.0-stored-cross-site-scriptin… (third-party-advisory)