LibreNMS CVE-2026-84189

Exploitation requires: (1) an authenticated LibreNMS administrator session, because oxidized.url is an admin-only configuration setting (PR:H); (2) the Oxidized integration must be enabled and its URL pointed at an attacker-controlled or attacker-influenceable server (the SSRF pivot); and (3) victim user interaction - a user must open a device's showconfig tab for the stored payload to execute (UI:P/R). Limiting factors: the admin privilege prerequisite means this is not exploitable by unauthenticated or low-privileged users against a default install, and the payload only triggers when someone views showconfig, so it is a stored/persistent condition dependent on the Oxidized feature being configured rather than a default-on remote bug.

The signals are moderately consistent. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/SC:H/SI:H) scores 9.2 and the vendor GHSA CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) scores 8.1 High - both correctly capture that exploitation requires high privileges (an administrator to set oxidized.url) plus victim interaction (a user must view a showconfig tab), with a scope/subsequent-system change reflecting that the injected script runs in other users' browser sessions. Publicly available exploit code exists (a confirmed mock Oxidized server), which raises practical risk, but this is NOT active exploitation - there is no CISA KEV listing and no EPSS score was provided. The PR:H requirement is the dominant limiting factor: an attacker generally needs admin control (or a compromised/socially-engineered admin) to weaponize this, which makes it a meaningful post-compromise privilege-lateralization and session-theft vector rather than a mass-exploitable unauthenticated bug. Net: a real, patch-worthy issue for LibreNMS operators, but its realistic priority is tempered by the admin prerequisite and the absence of in-the-wild exploitation.

An attacker who has obtained (or socially engineered) a LibreNMS admin session sets oxidized.url to http://attacker.example.com/, which serves JSON such as {"name":"<img src=x onerror=alert(1)>","ip":"x","model":"x"}. The payload is stored and rendered every time any operator opens a device's showconfig tab, running attacker JavaScript in each victim's authenticated session to steal cookies or perform actions on their behalf. A working proof-of-concept mock Oxidized server has already confirmed the injection fires.