CVE-2026-80214
8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Summary
LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| librenms | librenms | 23.10.0 < 26.4.1 | affected |
Weaknesses
- CWE-78: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: no
- Technical Impact: total
Additional References
References
- https://github.com/librenms/librenms/security/advisories/GHSA-7hmq-j399-mqwf
- https://projectblack.io/blog/librenms-authenticated-rce-26-5-0/#rce-by-command-line-injection-2641
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.