CVE-2026-84189

LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the device showconfig page without applying htmlspecialchars(), allowing persistent cross-site scripting (CWE-79). An administrator who points oxidized.url at an attacker-controlled server (SSRF scenario) can have that server return malicious JSON, which is then injected into the showconfig tab of every device. Any LibreNMS user who views any device's showconfig tab executes the attacker's script in their browser, giving the attacker high confidentiality and integrity impact against those sessions (e.g., acting as the victim user). All organizations running affected LibreNMS versions are exposed, though practical exploitation requires an attacker to control or influence the server configured in oxidized.url. There is currently no known exploitation, no public proof-of-concept, and a low EPSS score (0.3% over 30 days); LibreNMS 26.7.0 contains the fix.

What to do: Upgrade LibreNMS to 26.7.0 or later, which escapes the Oxidized JSON fields. As an interim mitigation, verify the current oxidized.url setting in the admin configuration and ensure it points only to your trusted internal Oxidized server, and restrict which administrators can change it. If an admin account may have been compromised, reset those credentials and review recent showconfig page viewers for signs of script execution.