LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and… (CVE-2026-84191)

The vulnerability identified as CVE-2026-84191 affects LibreNMS before version 26.5.0. It is a stored cross-site scripting (XSS) flaw in VRF display pages where certain SNMP-polled fields (mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher) are rendered without sanitization. An attacker with control over a monitored network device can inject malicious JavaScript via SNMP responses, which then executes in the context of any user accessing the affected VRF pages in LibreNMS. This vulnerability has a CVSS 3.1 base score of 6.1, indicating a medium severity level, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows an attacker controlling a monitored network device to execute arbitrary JavaScript in the browsers of LibreNMS users viewing VRF-related pages. This can lead to partial confidentiality and integrity impacts, such as theft of session tokens or manipulation of displayed data. There is no direct impact on system availability. The attack requires user interaction (viewing the affected pages) and no privileges on the LibreNMS system are needed.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when monitoring untrusted network devices and consider restricting access to VRF display pages or sanitizing SNMP data externally if possible.