This vulnerability allows an authenticated administrator to inject arbitrary shell commands when LibreNMS performs libvirt discovery. The defect stems from unsanitized device hostnames that are directly concatenated into exec() calls. An attacker who can alter a device's hostname can cause the discovery worker to run unintended commands, effectively gaining remote code execution on the host running LibreNMS.

Affected versions are LibreNMS 23.10.0 through 26.1.x. Versions 26.4.0 and later include the fix. The issue appears in the libvirt discovery feature when enable_libvirt is set to true, so all installations that enable libvirt support are impacted.

The CVSS score of 8.6 indicates high severity. EPSS data is currently unavailable and this vulnerability is not listed in CISA’s KEV catalog. Attack feasibility requires the attacker to have administrative privileges to set a hostname, and libvirt support must be enabled; however, once the vulnerability is exercised the impact is remote code execution in the discovery worker. There is no public exploit known, but the high CVSS and authentication requirement make inventorying privileged admins a priority.