---
id: CVE-2026-84194
title: >-
  LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an
  authenticated OS command injection vulnerability in libvirt discovery
summary: >-
  LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an
  authenticated OS command injection vulnerability in libvirt discovery. When
  libvirt support is enabled (enable_libvirt=true), the device hostname
  ($this->getDevice()-…
severity: none
cwe:
  - CWE-78
published: '2026-09-01'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:18:59.270'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84194'
references:
  - url: >-
      https://github.com/librenms/librenms/security/advisories/GHSA-wff2-9gjr-95f3
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/librenms-23.10.0-before-26.4.0-os-command-injection-via-hostname
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/librenms/librenms/security/advisories/GHSA-wff2-9gjr-95f3
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.01526
epssPercentile: 0.73609
ingestedAt: '2026-09-08T21:11:12.289Z'
---

## Overview

LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery. When libvirt support is enabled (enable_libvirt=true), the device hostname ($this->getDevice()->hostname) is concatenated into shell commands (ssh, virsh list/dumpxml/domstate) in VminfoLibvirt.php and passed to exec() without escapeshellarg() or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands, leading to remote code execution in the discovery worker context.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.