LibreNMS affected by reflected xss via email field

MEDIUM 6.1CVE-2026-26987 · GHSA-gqx7-99jw-6fpr · Published 20/02/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
librenms/librenms Packagist	`< 26.2.0`	`26.2.0`
librenms librenms	`< 26.2.0`	`26.2.0`

Description

Summary

reflected xss via email field

Details

visit http://127.0.0.1/settings/alerting/email
in the email address input but this payload <img src=1 onerror=alert(document.cookie)>
notice the alert

PoC

video attached with the report https://github.com/user-attachments/assets/c1b443f5-85c6-4545-b04f-def06d82b42e

Impact

can lead to ATO

NVD description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email field. This issue has been fixed in version 26.2.0.

References

librenms/librenms security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-26987 · ADVISORY
librenms/librenms#19038 · WEB
librenms/librenms commit 8e626b3 · WEB
librenms/librenms · PACKAGE
librenms/librenms release 26.2.0 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free