QwikSec

Security Database

CVE

CWE

Training

CVE-2026-26989

Published: Feb 20, 2026

Modified: Feb 20, 2026

PUBLISHED

CVSS v3.1

4.3

MEDIUM

Description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0.

Vendor	Product	Versions
librenms	librenms	affected `< 26.2.0`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

References

https://github.com/librenms/librenms/security/advisories/GHSA-6xmx-xr9p-58p7

x_refsource_CONFIRM

https://github.com/librenms/librenms/pull/19039

x_refsource_MISC

https://github.com/librenms/librenms/commit/087608cf9f851189847cb8e8e5ad002e59170c58

x_refsource_MISC

https://github.com/librenms/librenms/releases/tag/26.2.0

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.