Packagist/librenms/librenms CVE-2026-84189: high 8.1, EPSS 0.38%

LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page

Action: Upgrade librenms/librenms to 26.7.0 or later.

composer require librenms/librenms:26.7.0

Affected

Fixed versions

Sources

• osv: GHSA-7gww-x7fh-jf9j
• https://github.com/librenms/librenms/security/advisories/GHSA-7gww-x7fh-jf9j
• https://github.com/librenms/librenms
• https://github.com/librenms/librenms/releases/tag/26.7.0

CVE-2026-84189 · published 2026-08-18T21:17:23Z · modified 2026-09-02T03:55:41.484582443Z · JSON