CVE-2026-84194
LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname
CVSS Score
0.0
EPSS Score
1.4%
EPSS Percentile
70th
LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery. When libvirt support is enabled (enable_libvirt=true), the device hostname ($this->getDevice()->hostname) is concatenated into shell commands (ssh, virsh list/dumpxml/domstate) in VminfoLibvirt.php and passed to exec() without escapeshellarg() or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands, leading to remote code execution in the discovery worker context.
| CWE | CWE-78 |
| Vendor | librenms |
| Product | librenms |
| Published | Sep 1, 2026 |
| Last Updated | Sep 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for librenms librenms
Be the first to know when new unknown vulnerabilities affecting librenms librenms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
librenms / librenms
23.10.0 < 26.4.0
References
Credits
🔍 0xCraig