Description

LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary JavaScript through SNMP responses that executes in the browser of any user viewing VRF-related pages.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-01T12:17:48.587Z",
  "pubdate": "2026-09-01T12:17:48.587Z",
  "executiveSummary": "LibreNMS versions prior to 26.5.0 are susceptible to a stored Cross-Site Scripting (XSS) vulnerability residing within the application's VRF (Virtual Routing and Forwarding) display modules. The vulnerability stems from improper neutralization of user-supplied data ingested via SNMP polling.\nThe flaw allows an attacker with administrative control over a network device monitored by LibreNMS to inject arbitrary JavaScript payloads into SNMP response fields, specifically mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher. When a victim views the affected VRF-related pages, the malicious script is rendered by the browser within the context of the LibreNMS session.\nThis vulnerability presents a significant risk, as it enables attackers to perform unauthorized actions on behalf of the victim, potentially leading to session hijacking, credential theft, or unauthorized configuration changes within the LibreNMS environment. Exploitation does not require direct access to the LibreNMS server itself, but rather relies on the ability to influence SNMP data originating from a managed network device. Organizations utilizing LibreNMS should prioritize upgrading to version 26.5.0 or later to remediate the lack of input sanitization.",
  "technicalDetails": "The vulnerability is a classic Stored XSS issue characterized by the failure of the LibreNMS web interface to properly sanitize or encode data retrieved from SNMP polling before rendering it in the DOM (Document Object Model). The application architecture implicitly trusts the integrity of the data returned by managed network devices, which is a faulty assumption when the devices themselves may be compromised or malicious.\nSpecifically, the affected fields are mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher. These fields are parsed by the SNMP polling engine and stored in the underlying database. The vulnerability manifests when the web application retrieves these strings to display them in the VRF management or monitoring dashboard. Because the application fails to perform contextual output encoding or utilize secure templating mechanisms, the browser interprets the injected JavaScript as executable code rather than plain text.\nThe attack flow proceeds as follows: 1. An attacker modifies the SNMP configuration or administrative name on a network device that is currently being polled by LibreNMS. The attacker inserts a JavaScript payload into one of the vulnerable SNMP OID fields (e.g., mplsVpnVrfDescription). 2. The LibreNMS SNMP poller periodically updates its database by querying the compromised device, effectively 'storing' the malicious payload within the LibreNMS database schema. 3. A victim, such as a network administrator or operator, accesses the VRF-related page within the LibreNMS GUI. 4. The server responds with an HTML page containing the stored payload rendered directly into the source code. 5. The victim's browser parses the malicious script, leading to execution in the context of the authenticated user's session.\nBecause the execution occurs within the context of the LibreNMS application, the script can interact with session cookies, perform requests to the LibreNMS API, or exfiltrate sensitive data visible to the logged-in user. There is no requirement for the attacker to have direct authentication or privilege levels within LibreNMS; the attack vector is entirely externalized through the network management protocol. This highlights a critical lack of defense-in-depth regarding input validation at the data ingestion layer of the monitoring framework. Post-exploitation impact includes persistent execution for any user accessing the tainted monitoring dashboard, making it an effective vector for targeting administrative users to gain full application control."
}