LibreNMS CVE-2026-84191

Exploitation requires two concrete prerequisites: (1) the attacker must control a network device - either by compromising it or operating a rogue device - that is actively monitored by the target LibreNMS instance via SNMP polling; (2) the LibreNMS instance must be monitoring MPLS VPN infrastructure such that VRF data (mplsVpnVrfDescription, vrf_name, mplsVpnVrfRouteDistinguisher) is being collected and the VRF display pages are rendered for users. Exploitation is additionally gated by passive user interaction (UI:P in CVSS 4.0): a LibreNMS user must navigate to a VRF-related display page after the payload is stored. Authentication requirements on the LibreNMS user side are not independently constrained by this vulnerability - any user with page access is affected. Environments not monitoring MPLS VPN devices, or where VRF polling is disabled, are not exposed.

The CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:P captures the indirect exploitation model: the attacker requires no privileges on LibreNMS itself, but does require control over a network device actively monitored by the target instance. The stored nature elevates real-world risk above reflected XSS: a single SNMP poisoning event affects all subsequent page views by all users until sanitized. The MPLS VRF feature requirement is a meaningful limiting factor - only LibreNMS deployments actively monitoring MPLS VPN infrastructure will have VRF pages populated and rendered. No KEV listing and no POC are noted, keeping exploitation probability low for opportunistic attackers, but the prerequisite of controlling a managed device is realistic in supply-chain, rogue-device, or insider threat scenarios. Overall: medium-priority for network operators running MPLS-capable LibreNMS environments; lower priority for environments without MPLS VPN monitoring.

An attacker who has compromised or controls a router running MPLS VPN that is being actively polled by LibreNMS crafts SNMP responses containing a JavaScript payload in the mplsVpnVrfDescription OID value. On the next LibreNMS polling cycle, the payload is stored in the LibreNMS database. When any authenticated LibreNMS user navigates to the VRF display page for that device, the injected script executes in their browser, potentially exfiltrating session cookies to an attacker-controlled endpoint. No public exploit code is identified at time of analysis.