LibreNMS: reflected XSS in the Proxmox view runs script in a logged-in monitoring user's session

Impact

The instance and vmid GET parameters of the Proxmox view are placed into the page title with only strip_tags applied, and the title is then interpolated into an inline document.title assignment, so a single quote closes the JavaScript string and the rest of the input executes. An operator who follows a crafted link while logged in runs the attacker's script with their LibreNMS session, which allows session data theft and any action the UI offers that account. LibreNMS holds SNMP and device credentials for the fabric it polls, so a hijacked NOC session is a foothold into network management rather than just a defaced page. This needs the victim to click, and it is a browser-session compromise - it does not by itself give code execution on the LibreNMS host.

Who can reach it

An attacker who can get an already-authenticated LibreNMS user to open a crafted URL. The attacker needs a low-privileged authenticated position per the vendor scoring, and the victim must interact.

What to do

Upgrade LibreNMS to 26.5.0, or apply commit 0be1bfd7746cea26bf7da40e82b70f75b724d0f8 if you track git. This is a code update to the web application - no node drain or reboot, though php-fpm or the web worker should be reloaded after the update.

References

Related entries

• Strimzi: partial Entity Operator deployments still get both operators' RBAC, over-granting the SACVE-2026-55226 · Strimzi Kafka Operator (Entity Operator ServiceAccount RBAC)Medium
• Jenkins Stapler: form binding writes public static fields, applying changes instance-wideCVE-2026-84654 · Jenkins Stapler (form data binding to public static fields)Medium
• Jenkins Pipeline: Build Step Plugin: downstream builds cancelled without Item/Cancel permission checkCVE-2026-84660 · Jenkins Pipeline: Build Step Plugin (build and waitForBuild step cancellation)Medium
• Jenkins Pipeline: Groovy Libraries plugin: CSRF lets an unauthenticated attacker delete library cachesCVE-2026-84663 · Jenkins Pipeline: Groovy Libraries Plugin (shared library cache deletion endpoint)Medium
• Jenkins GitLab plugin: global connection URL can be overwritten, sending admin API tokens to an attackerCVE-2026-84664 · Jenkins GitLab Plugin (global connection configuration via Stapler data binding)Medium
• Jenkins Job Configuration History Plugin: attackers redirect history storage to a directory of their choosingCVE-2026-84666 · Jenkins Job Configuration History Plugin (history recording config via Stapler data binding)Medium