LibreNMS Oxidized Integration Stored XSS via Admin Configuration

LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the device showconfig page without applying htmlspecialchars(). An administrator who points the Oxidized URL at an attacker-controlled server (SSRF) can cause it to return malicious JSON, resulting in stored/persistent cross-site scripting affecting all users who view any device's showconfig tab. Fixed in 26.7.0.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

LibreNMS versions through 26.4.0 contain a stored cross-site scripting (XSS) vulnerability in the device showconfig page, where JSON fields from an admin-configurable Oxidized integration URL are rendered without HTML encoding. An attacker who gains control over the Oxidized URL endpoint—either through compromise or by convincing an administrator to point to a malicious server—can inject arbitrary JavaScript that persists in the application and executes for all users viewing device configurations. This affects any LibreNMS deployment using the Oxidized integration feature, particularly impacting organizations managing network device backups and configurations. With a CVSS score of 8.1, this represents a high-severity risk for persistent compromise of administrator and operator sessions.

Casky's 323 matching security skills, powered by Claude's extended reasoning capabilities, detect this attack pattern by correlating MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance via admin configuration discovery) with observable behaviors: injection of unencoded JSON payloads into web application rendering contexts (CWE-79), abnormal Oxidized URL configurations pointing to unexpected domains, and persistence indicators showing XSS payloads stored in device configuration data. Practitioners using Casky would receive findings highlighting suspicious JSON field values containing script tags, detection of HTML entities missing from application output, and behavioral analysis showing how admin-controlled external integrations can become attack vectors when input validation is insufficient—enabling them to implement proper output encoding or restrict Oxidized URL configuration to trusted sources.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-84189.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-84189

Casky has 323 skills that investigate the attack patterns behind CVE-2026-84189. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn