Login Request a demo
Medium severity · published Feb 20, 2026
CVE-2026-26991
LibreNMS vulnerable to Stored Cross-site Scripting through unsanitized /device-groups name
4.8
CVSS
0.2%
EPSS
No
On KEV
Description
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the device group name is not sanitized, allowing attackers with admin privileges to perform Stored Cross-Site Scripting (XSS) attacks. When a user adds a device group, an HTTP POST request is sent to the Request-URI "/device-groups". The name of the newly created device group is stored in the value of the name parameter. After the device group is created, the entry is displayed along with relevant buttons such as Rediscover Devices, Edit, and Delete. This issue has been fixed in version 26.2.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
librenms · librenms
< 26.2.0 · source: vendor, NVD
Affected product
LI
librenms
librenms
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-26991
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-26991
Patch
https://github.com/librenms/librenms/commit/64b31da444369213eb4559ec1c304ebfaa0ba12c
Issue Tracking
https://github.com/librenms/librenms/pull/19041
Product
https://github.com/librenms/librenms/releases/tag/26.2.0
Exploit
https://github.com/librenms/librenms/security/advisories/GHSA-5pqf-54qp-32wx
More from librenms
9.8
CVE-2026-86426
LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion
9.8
CVE-2022-4070
Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0
9.8
CVE-2022-29712
LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters
9.8
CVE-2021-44278
Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php
9.8
CVE-2019-10665
An issue was discovered in LibreNMS through 1.47