CVE-2026-26991

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-26991

4.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

L

ibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the device group name is not sanitized, allowing attackers with admin privileges to perform Stored Cross-Site Scripting (XSS) attacks. When a user adds a device group, an HTTP POST request is sent to the Request-URI "/device-groups". The name of the newly created device group is stored in the value of the name parameter. After the device group is created, the entry is displayed along with relevant buttons such as Rediscover Devices, Edit, and Delete. This issue has been fixed in version 26.2.0.

References
Link Resource
https://github.com/librenms/librenms/commit/64b31da444369213eb4559ec1c304ebfaa0ba12c Patch
https://github.com/librenms/librenms/pull/19041 Issue Tracking
https://github.com/librenms/librenms/releases/tag/26.2.0 Product Release Notes
https://github.com/librenms/librenms/security/advisories/GHSA-5pqf-54qp-32wx Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*
History

20 Feb 2026, 16:21

Type Values Removed Values Added
First Time Librenms
Librenms librenms
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.8
CPE cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*
Summary
  • (es) LibreNMS es una herramienta de monitorización de red basada en PHP/MySQL/SNMP con descubrimiento automático. En las versiones 26.1.1 y anteriores, el nombre del grupo de dispositivos no está saneado, permitiendo a atacantes con privilegios de administrador realizar ataques de Cross-Site Scripting (XSS) almacenado. Cuando un usuario añade un grupo de dispositivos, se envía una solicitud HTTP POST a la Request-URI '/device-groups'. El nombre del grupo de dispositivos recién creado se almacena en el valor del parámetro name. Después de que se cree el grupo de dispositivos, la entrada se muestra junto con botones relevantes como Rediscover Devices, Edit y Delete. Este problema ha sido solucionado en la versión 26.2.0.
References () https://github.com/librenms/librenms/commit/64b31da444369213eb4559ec1c304ebfaa0ba12c - () https://github.com/librenms/librenms/commit/64b31da444369213eb4559ec1c304ebfaa0ba12c - Patch
References () https://github.com/librenms/librenms/pull/19041 - () https://github.com/librenms/librenms/pull/19041 - Issue Tracking
References () https://github.com/librenms/librenms/releases/tag/26.2.0 - () https://github.com/librenms/librenms/releases/tag/26.2.0 - Product, Release Notes
References () https://github.com/librenms/librenms/security/advisories/GHSA-5pqf-54qp-32wx - () https://github.com/librenms/librenms/security/advisories/GHSA-5pqf-54qp-32wx - Exploit, Third Party Advisory

20 Feb 2026, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-20 03:15

Updated : 2026-02-20 16:21

NVD link : CVE-2026-26991

Mitre link : CVE-2026-26991

CVE.ORG link : CVE-2026-26991

JSON object : View

Products Affected

librenms

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')