CVE-2026-26989

LibreNMS has Stored XSS in Alert Rule

CVSS 4.3 MEDIUMEPSS 0.2%CWE-79

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 4.3EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

20 Feb 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0.

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Affected products

librenms · librenms

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/librenms/librenms/commit/087608cf9f851189847cb8e8e5ad002e59170c58 https://github.com/librenms/librenms/pull/19039 https://github.com/librenms/librenms/releases/tag/26.2.0 https://github.com/librenms/librenms/security/advisories/GHSA-6xmx-xr9p-58p7