CVE-2026-26989: LibreNMS has Stored XSS in Alert Rule

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-20 · updated 2026-06-17
Weakness: CWE-79

Description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0.

Affected products

librenms: before 26.2.0 — fixed in 26.2.0

How to fix

Upgrade to a fixed version: librenms 26.2.0. Check the vendor advisory for mitigations.

References

https://github.com/librenms/librenms/commit/087608cf9f851189847cb8e8e5ad002e59170c58
https://github.com/librenms/librenms/pull/19039
https://github.com/librenms/librenms/releases/tag/26.2.0
https://github.com/librenms/librenms/security/advisories/GHSA-6xmx-xr9p-58p7

Get alerted when CVE-2026-26989 or the next vulnerability affects your stack