{"id":"CVE-2026-84194","title":"LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery","summary":"LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery. When libvirt support is enabled (enable_libvirt=true), the device hostname ($this->getDevice()-…","severity":"none","cwe":["CWE-78"],"published":"2026-09-01","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:18:59.270","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84194","references":[{"url":"https://github.com/librenms/librenms/security/advisories/GHSA-wff2-9gjr-95f3","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/librenms-23.10.0-before-26.4.0-os-command-injection-via-hostname","label":"disclosure@vulncheck.com"},{"url":"https://github.com/librenms/librenms/security/advisories/GHSA-wff2-9gjr-95f3","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.01391,"epssPercentile":0.71168,"ingestedAt":"2026-09-08T21:11:12.289Z","slug":"CVE-2026-84194","body":"## Overview\n\nLibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery. When libvirt support is enabled (enable_libvirt=true), the device hostname ($this->getDevice()->hostname) is concatenated into shell commands (ssh, virsh list/dumpxml/domstate) in VminfoLibvirt.php and passed to exec() without escapeshellarg() or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands, leading to remote code execution in the discovery worker context.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}