Vulnerability · Published Feb 20, 2026 · Assigned by GitHub_M

CVE-2026-26989LibreNMS has Stored XSS in Alert Rule

Medium 4.3

In plain English

A medium-severity cross-site scripting in librenms from librenms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 80.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	librenms/librenms	26.2.0	GHSA-6xmx-xr9p-58p7

Affected products (as reported)

Vendor	Product	Versions
librenms	librenms	< 26.2.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

References

https://github.com/librenms/librenms/security/advisories/GHSA-6xmx-xr9p-58p7 x_refsource_CONFIRM
https://github.com/librenms/librenms/pull/19039 x_refsource_MISC
https://github.com/librenms/librenms/commit/087608cf9f851189847cb8e8e5ad002e59170c58 x_refsource_MISC
https://github.com/librenms/librenms/releases/tag/26.2.0 x_refsource_MISC