5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26987

CVE-2026-26987: LibreNMS affected by reflected xss via email field

Summary

reflected xss via email field

Details

visit http://127.0.0.1/settings/alerting/email
in the email address input but this payload <img src=1 onerror=alert(document.cookie)>
notice the alert

PoC

video attached with the report https://github.com/user-attachments/assets/c1b443f5-85c6-4545-b04f-def06d82b42e

Impact

can lead to ATO

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26987

CVE-2026-26987:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
librenms/librenms	composer	< 26.2.0	26.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a reflected Cross-Site Scripting (XSS) issue in LibreNMS. The analysis of the provided commit 8e626b38ef92e240532cdac2ac7e38706a71208b reveals the exact location of the vulnerability and its fix. The patch is in the resources/js/components/LibrenmsSetting.vue file, specifically within the update method of the Vue component. The vulnerable code was toastr.error(error.response.data.message);. This line took an error message from the server, which reflected user input from a form field (like the email setting), and displayed it. The toastr library would render this message as HTML, leading to the execution of any embedded JavaScript. The fix involves creating a DOM element (<span>), setting its textContent to the error message to ensure it's treated as plain text, and then passing the element to toastr.error. This prevents the browser from interpreting the malicious payload. Therefore, the update function in the LibrenmsSetting component is the key client-side function involved in triggering the vulnerability.

Vulnerable functions

LibrenmsSetting.update

resources/js/components/LibrenmsSetting.vue

The `update` method in the `LibrenmsSetting.vue` component is responsible for sending setting changes to the server. In the vulnerable version, if the server returned an error, the error message (which could contain user-supplied input) was passed directly to `toastr.error`. This function rendered the message as HTML, allowing a malicious payload in the user input to be executed as a reflected Cross-Site Scripting (XSS) attack. The patch mitigates this by creating a text node for the error message, ensuring it is not interpreted as HTML.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.