CVE-2026-26989

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26989", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-17T01:41:24.606Z", "datePublished": "2026-02-20T01:25:31.936Z", "dateUpdated": "2026-02-20T15:34:55.873Z"}, "containers": {"cna": {"title": "LibreNMS has Stored XSS in Alert Rule", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/librenms/librenms/security/advisories/GHSA-6xmx-xr9p-58p7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/librenms/librenms/security/advisories/GHSA-6xmx-xr9p-58p7"}, {"name": "https://github.com/librenms/librenms/pull/19039", "tags": ["x_refsource_MISC"], "url": "https://github.com/librenms/librenms/pull/19039"}, {"name": "https://github.com/librenms/librenms/commit/087608cf9f851189847cb8e8e5ad002e59170c58", "tags": ["x_refsource_MISC"], "url": "https://github.com/librenms/librenms/commit/087608cf9f851189847cb8e8e5ad002e59170c58"}, {"name": "https://github.com/librenms/librenms/releases/tag/26.2.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/librenms/librenms/releases/tag/26.2.0"}], "affected": [{"vendor": "librenms", "product": "librenms", "versions": [{"version": "< 26.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-20T01:25:31.936Z"}, "descriptions": [{"lang": "en", "value": "LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0."}], "source": {"advisory": "GHSA-6xmx-xr9p-58p7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T15:26:36.141583Z", "id": "CVE-2026-26989", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:34:55.873Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26989", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T15:26:36.141583Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:26:37.884Z"}}], "cna": {"title": "LibreNMS has Stored XSS in Alert Rule", "source": {"advisory": "GHSA-6xmx-xr9p-58p7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "librenms", "product": "librenms", "versions": [{"status": "affected", "version": "< 26.2.0"}]}], "references": [{"url": "https://github.com/librenms/librenms/security/advisories/GHSA-6xmx-xr9p-58p7", "name": "https://github.com/librenms/librenms/security/advisories/GHSA-6xmx-xr9p-58p7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/librenms/librenms/pull/19039", "name": "https://github.com/librenms/librenms/pull/19039", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/librenms/librenms/commit/087608cf9f851189847cb8e8e5ad002e59170c58", "name": "https://github.com/librenms/librenms/commit/087608cf9f851189847cb8e8e5ad002e59170c58", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/librenms/librenms/releases/tag/26.2.0", "name": "https://github.com/librenms/librenms/releases/tag/26.2.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-20T01:25:31.936Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26989", "state": "PUBLISHED", "dateUpdated": "2026-02-20T15:34:55.873Z", "dateReserved": "2026-02-17T01:41:24.606Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-20T01:25:31.936Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "librenms", "vendor": "librenms", "versions": [{"status": "affected", "version": "< 26.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*", "matchCriteriaId": "C0838E1C-0369-4B31-9B51-83A5D2A7CAC9", "versionEndExcluding": "26.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0."}, {"lang": "es", "value": "LibreNMS es una herramienta de monitorizaci\u00f3n de red basada en PHP/MySQL/SNMP con auto-descubrimiento. Las versiones 25.12.0 e inferiores est\u00e1n afectadas por una vulnerabilidad de Cross-Site Scripting Almacenado (XSS) en el flujo de trabajo de Reglas de Alerta. Un atacante con privilegios de administrador puede inyectar scripts maliciosos que se ejecuten en el contexto del navegador de cualquier usuario que acceda a la p\u00e1gina de Reglas de Alerta. Este problema ha sido solucionado en la versi\u00f3n 26.2.0."}], "id": "CVE-2026-26989", "lastModified": "2026-06-17T10:26:29.817", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26989", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T15:26:36.141583Z", "version": "2.0.3"}}]}, "published": "2026-02-20T02:16:54.710", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/librenms/librenms/commit/087608cf9f851189847cb8e8e5ad002e59170c58"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/librenms/librenms/pull/19039"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/librenms/librenms/releases/tag/26.2.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/librenms/librenms/security/advisories/GHSA-6xmx-xr9p-58p7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "librenms", "source": "cna", "vendor": "librenms"}, "product": "librenms", "vendor": "librenms"}], "analysis": {"en": {"generated_at": "2026-04-17T17:34:53.241304+00:00", "value": {"mitigation_remediation": ["Upgrade the LibreNMS installation to version 26.2.0 or later, which removes the stored\u2011XSS code path.", "If any alerts or rules have already been injected with malicious scripts, delete or edit those entries prior to applying the patch to eliminate residual payloads.", "Restrict the Alert Rules page and administration functions to the narrowest user group necessary; enable least\u2011privilege access controls and monitor for any unauthorized changes to alert configurations."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All LibreNMS installations running version 25.12.0 or earlier. The Vulnerability Authority lists the affected vendor as librenms and the product as LibreNMS. The issue has been addressed in release 26.2.0, so any deployment of 26.2.0 or later is considered mitigated.", "description_and_impact": "LibreNMS, an auto\u2011discovering PHP/MySQL networking tool, contains a stored cross\u2011site scripting flaw, classified as CWE\u201179, within its Alert Rules management interface. An administrator who can edit alert rules may embed arbitrary script content that persists in the database and executes in the browsers of any user who subsequently views the Alert Rules page. The attack therefore allows privilege\u2011elevated insiders or compromised admin accounts to run code within the context of other legitimate users, potentially enabling session hijacking, navigation hijack, or defacement of the web interface. The vulnerability does not grant direct arbitrary code execution on the host, but it does compromise user accounts and confidentiality of visible data.", "risk_and_exploitability": "The vulnerability scores a moderate CVSS of 4.3 and a very low EPSS (<1%). It is not catalogued in the CISA Known Exploited Vulnerabilities list. Exploitation requires administrative credentials to inject the payload. Once injected, the script runs in the browser context of any user who accesses the Alert Rules page, yielding local\u2011browser attacks but not remote code execution on the server. Due to the low exploitation probability and moderate severity, the risk level is moderate but remediation is recommended before any potential exploitation is detected."}}}}, "created": "2026-02-20T09:53:01.665220+00:00", "updated": "2026-04-17T17:45:24.340245+00:00", "vendors": ["librenms", "librenms$PRODUCT$librenms"]}