LibreNMS: device hostname is concatenated into shell commands in libvirt discovery, giving RCE

Impact

When libvirt support is enabled, the device hostname is pasted straight into the ssh and virsh command lines and handed to exec() with no escaping, so an admin who sets a crafted hostname gets arbitrary command execution as the discovery worker on the LibreNMS host. That host is usually the most credential-rich box in the management network - SNMP community strings, SSH keys and API tokens for switches, BMCs and hypervisors across the fleet - so an application-level admin role converts into infrastructure-wide credential access. The bug only exists on installs running with enable_libvirt=true. Because it needs an existing admin account, treat it as a privilege-boundary break and a lateral-movement step rather than a front-door compromise, though it matters more wherever the admin role is delegated broadly.

Who can reach it

Authenticated LibreNMS user with admin rights, via the normal web UI or API path that adds or edits a device hostname. Only exploitable where enable_libvirt=true; no access to the underlying host is needed beforehand.

What to do

Upgrade LibreNMS to 26.4.0 or later - the record states versions >= 23.10.0 and < 26.2.0 are affected with the fix in 26.4.0. This is a web-application upgrade: update the code, restart php-fpm and the poller/discovery workers; no GPU node is touched. If you cannot upgrade immediately, set enable_libvirt=false, which removes the vulnerable discovery module entirely, and audit existing device hostnames for shell metacharacters.

References

Related entries

• VMware Aria Automation (SQL injection): An authenticated user injects SQL and performs unauthorized read/writeCVE-2024-22280 · VMware Aria Automation (SQL injection)High
• VMware Aria Operations for Logs (credential disclosure): A View Only Admin reads the credentials of other VMwareCVE-2025-22218 · VMware Aria Operations for Logs (credential disclosure)High
• VMware vCenter (SMTP header injection via scheduled tasks): A non-administrative user with scheduled-task permissionsCVE-2025-41250 · VMware vCenter (SMTP header injection via scheduled tasks)High
• AMD NBIO register lock bits - System Management Network access: NBIO registers that should be locked after boot areCVE-2025-61972 · AMD NBIO register lock bits - System Management Network accessHigh
• Pure Storage FlashBlade logging: Sensitive material ends up in FlashBlade logs under certain conditions, and the scoredCVE-2026-0207 · Pure Storage FlashBlade loggingHigh
• GitLab package registry: authenticated path traversal that can lead to remote code executionCVE-2026-10053 · GitLab CE/EE package registryHigh