Authenticated RCE in LibreNMS Signal Alert Transport

Successful exploitation allows an authenticated administrator to execute arbitrary operating system commands on the LibreNMS host. This can lead to full compromise of the monitored server, including unauthorized access to application data, credential theft, modification of monitoring configuration, deployment of additional payloads, persistence, data exfiltration, and potential lateral movement to connected systems.

Until patched, restrict access to LibreNMS administrative functionality to a minimal set of trusted users and tightly limit exposure of the management interface. Disable or avoid use of the Signal alert transport module if it is not required. Prevent user-controlled values from reaching shell execution paths, avoid direct use of exec-style functions for alert transport handling, and enforce server-side restrictions on executable path configuration so such settings cannot be modified through the web interface. Additional hardening such as process isolation, least-privilege service accounts, and monitoring for unexpected command execution can reduce impact.

Upgrade LibreNMS to version 26.5.0 or later. Remediation should also ensure that user-controlled input is no longer passed into command execution paths without strict validation and safe handling. Direct execution of attacker-influenced values in the affected wrapper and Signal transport logic should be removed or redesigned, and executable path configuration should be constrained so it cannot be abused through the web application.