Skip to content

LibreNMS

v26.6.0 Security

This release includes 5 security fixes for security teams reviewing exposed deployments.

Published 1mo Monitoring & Metrics
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 5 known CVEs

Topics

laravel librenms monitoring network php rrd
+1 more
snmp

Affected surfaces

auth rbac deps

ReleasePort's take

Moderate signal
editorial:auto 1mo

The release addresses critical security flaws in storage tables and API endpoints while adding new configuration options and UI fields.

Why it matters: Fixes XSS (severity 90) and CSRF (severity 85) vulnerabilities that could compromise web UI and API access; deploy to protect data integrity.

Summary

AI summary

Broad release touches https://github.com/murrant, https://github.com/laf, Webui, and Bug.

Changes in this release

Security Critical

Update storage table to remove XSS vulnerabilities.

Update storage table to remove XSS vulnerabilities.

Source: llm_adapter@2026-06-15

Confidence: high

Security High

Add CSRF check into ajax_form.php to prevent cross‑site request forgery.

Add CSRF check into ajax_form.php to prevent cross‑site request forgery.

Source: llm_adapter@2026-06-15

Confidence: high

Security High

Implement and improve permission checks across APIs and UI components.

Implement and improve permission checks across APIs and UI components.

Source: llm_adapter@2026-06-15

Confidence: high

Feature Medium

Add SnmpEngineID field to Core device discovery and edit pages.

Add SnmpEngineID field to Core device discovery and edit pages.

Source: llm_adapter@2026-06-15

Confidence: high

Feature Medium

Introduce graylog.match-any-address configuration option for log routing.

Introduce graylog.match-any-address configuration option for log routing.

Source: llm_adapter@2026-06-15

Confidence: high

Feature Medium

Add wireless sensors endpoint to the API.

Add wireless sensors endpoint to the API.

Source: llm_adapter@2026-06-15

Confidence: high

Dependency Medium

Bump esbuild, vite and laravel-vite-plugin to latest versions.

Bump esbuild, vite and laravel-vite-plugin to latest versions.

Source: llm_adapter@2026-06-15

Confidence: high

Dependency Medium

Raise minimum required RRDtool version to 1.5.5.

Raise minimum required RRDtool version to 1.5.5.

Source: llm_adapter@2026-06-15

Confidence: high

Bugfix Medium

Fix RRD error handling to prevent crashes during data retrieval.

Fix RRD error handling to prevent crashes during data retrieval.

Source: llm_adapter@2026-06-15

Confidence: high

Bugfix Medium

Change "vsz" column data type to BIGINT to accommodate larger values.

Change "vsz" column data type to BIGINT to accommodate larger values.

Source: llm_adapter@2026-06-15

Confidence: low

Bugfix Low

Change "vsz" column type to BIGINT in the database schema.

Change "vsz" column type to BIGINT in the database schema.

Source: granite4.1:30b@2026-06-15-audit

Confidence: low

Full changelog

26.6.0

(2026-06-15)

A big thank you to the following 32 contributors this last month:

Thanks to maintainers and others that helped with pull requests this month:

Feature

  • Added SnmpEngineID to Core discovery and edit device page (#19685) - laf

Security

  • Update storage table to remove xss (#19896) - laf
  • Added validation for ajax/select/port filter (#19877) - laf
  • Check user has permission to access port for search_by_mac api function (#19876) - laf
  • Stop leaking data when host add fails via api (#19870) - laf
  • Stop widgets being moved that don't belong to that dashboard (#19868) - laf
  • Fix some possible xss in various tables (#19867) - laf
  • Validate wireless sensor updates against static list (#19863) - laf
  • Add device permission check to add_eventlog api call (#19862) - laf
  • Added a csrf check into ajax_form.php (#19859) - laf
  • First round of updates to improve security (#19856) - laf
  • Permissions implementations and improvements (#19643) - murrant

Device

Webui

Alerting

Api

Discovery

Polling

Authentication

Bug

Refactor

Cleanup

Documentation

Translation

Tests

Misc

Dependencies

Security Fixes

  • Removed XSS vulnerabilities from storage tables and various UI tables
  • Added CSRF check to ajax_form.php
  • Validated ajax/select/port filters against allowed values
  • Enforced device‑permission checks for API endpoints (search_by_mac, add_eventlog)
  • Prevented data leakage when host addition via API fails

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track LibreNMS

Get notified when new releases ship.

Sign up free

About LibreNMS

Community-based GPL-licensed network monitoring system

All releases →

Related context

Beta — feedback welcome: [email protected]