CVE-2026-84194: LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname

Severity: high (CVSS 8.6 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-01 · updated 2026-09-08
Weakness: CWE-78

Description

LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery. When libvirt support is enabled (enable_libvirt=true), the device hostname ($this->getDevice()->hostname) is concatenated into shell commands (ssh, virsh list/dumpxml/domstate) in VminfoLibvirt.php and passed to exec() without escapeshellarg() or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands, leading to remote code execution in the discovery worker context.

Affected products

librenms: from 23.10.0 before 26.4.0 — fixed in 26.4.0

How to fix

Upgrade to a fixed version: librenms 26.4.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-84194 or the next vulnerability affects your stack