CVE-2026-84194

LibreNMS versions 23.10.0 up to (but not including) 26.2.0 contain an authenticated OS command injection flaw (CWE-78) in the libvirt virtual machine discovery code (VminfoLibvirt.php). When libvirt support is enabled (enable_libvirt=true), the device hostname is concatenated without escapeshellarg() or argument separation into shell commands (ssh and virsh list/dumpxml/domstate) that are run via exec(), so a hostname containing shell metacharacters injects arbitrary operating system commands. An authenticated admin-level user who can set a crafted device hostname gains remote code execution on the LibreNMS server in the discovery worker context. Only deployments with libvirt monitoring enabled are affected, and the issue is fixed in 26.4.0. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at about 1.4% (71st percentile), so no confirmed in-the-wild exploitation is known.

What to do: Upgrade LibreNMS to 26.4.0 or later. As interim mitigation, set enable_libvirt=false (or restrict which administrators can set device hostnames) and avoid hostnames containing shell metacharacters; review existing device hostnames and discovery logs for signs of injected commands.