CVE-2026-80214
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
LibreNMS's Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server.
Risk Assessment
A person with administrator privileges can execute arbitrary commands on the server, potentially leading to full infrastructure compromise.
Recommendation
Restrict access to the Virtualization Discovery module to trusted administrators only and apply security updates.
Other vulnerabilities in LibreNMS
See all- CVE-2020-15878Unknown
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the address parameter in the /ajax_table.php API endpoint.
- CVE-2020-15876Unknown
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajax_table.php API endpoint. This affects many files in includes/html/table.
- CVE-2020-15874Unknown
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint.
- CVE-2024-51092Critical
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().
- CVE-2026-55182High
LibreNMS versions from 21.6.0 up to 26.5.0 are vulnerable to command injection in the Signal alert transport because the signal-cli path and the Recipient field are insufficiently escaped before being passed to an exec call. An authenticated administrator can execute arbitrary OS commands on the LibreNMS host.
- CVE-2026-45694Medium
LibreNMS up to version 26.4.0 is vulnerable to reflected cross-site scripting in the Proxmox application view through user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. This issue is fixed in version 26.5.0.
Original NVD description (English source)
LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server.