Skip to content

LibreNMS

v26.7.0 Security

This release includes 7 security fixes for security teams reviewing exposed deployments.

Published 6d Monitoring & Metrics
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 7 known CVEs

Topics

laravel librenms monitoring network php rrd
+1 more
snmp

Affected surfaces

auth rbac

Summary

AI summary

Broad release touches https://github.com/murrant, https://github.com/laf, Bug, and Webui.

Full changelog

26.7.0

(2026-07-20)

A big thank you to the following 39 contributors this last month:

Thanks to maintainers and others that helped with pull requests this month:

Feature

  • Device down status reason show all (#19892) - murrant
  • Added support for Unimus.net device config (#19885) - laf
  • Add support for snmp contexts to devices and updated bgp-peers modules (#19732) - laf

Breaking Change

  • Validate port parsing script lives in includes/ folder and is a php f… (#19865) - laf

Security

  • Security fix for VRF displayName xss (#20096) - laf
  • Security fix for F5 file inclusion (#20093) - laf
  • Security fix for PeeringDB xss (#20091) - laf
  • Security fix for Wireless edit page (#20090) - laf
  • Security fix for procedure URLs in alerts table (#20088) - laf
  • Security fix for Graph group and nfsen includes (#20087) - laf
  • Escape url helpers more consistently (#20004) - murrant
  • Update PHP dependencies (#19932) - murrant
  • Added permissions to editing/viewing notes (#19861) - laf

Device

Webui

Alerting

Graphs

Applications

Billing

Api

  • Fix Services API to allow optional name (#20079) - laf
  • Fix health API returning empty results for processor, storage and mempool (#19953) - abhishekambastha

Polling

  • Poll port-channel membership so changes are visible within one poll cycle (#19620) - shward
  • Only update ping stats in poller and improve fast ping speed (#18674) - eskyuu

Authentication

Bug

  • Increase access_points.interference to a smallint (#20118) - laf
  • Fix bill graph 95th percentile calculation under ONLY_FULL_GROUP_BY (#20102) - Gez7
  • Fix hp blade system fan+psu discovery (#20075) - si458
  • Stop bad entStateLastChanged breaking entity-physical discovery (#20072) - laf
  • Sync modules to OS Schema to fix config:set (#20070) - laf
  • Changing status reason should not trigger a log message (#20035) - murrant
  • Device_display_default setting should invalidate device display name cache (#20032) - murrant
  • Fix unix agent not polling (#20029) - murrant
  • Fix undefined variable $all_return with legacy extend script output (#20027) - MHammett
  • Fix/graphpopup mini graph size (#20003) - Torstein-Eide
  • Fix device existence check (#20002) - murrant
  • Alter REP Segment numbering to match Cisco's numbering (#19999) - rudybroersma
  • Fix bad ports-stack module function call (#19996) - murrant
  • Fix boolean filters showing Yes for 0 when accessed from url (#19992) - laf
  • Expand eventlog columns and truncate interface column (#19974) - laf
  • Cleanup SslCertificate Model (#19970) - murrant
  • Query Builder cleanup (#19967) - murrant
  • Proxmox ignore bad input (#19965) - murrant
  • Fix the dashboard widgets edit/delete (#19962) - laf
  • Updated mpls_saps.sapsDescription to 160 varchar (#19959) - laf
  • Normalise null details at load site in RunAlerts (#19958) - Starson323
  • Changed master channel exit code to 2 (#19954) - laf
  • Restore edit device functionality (#19934) - laf
  • Fix bill pages using unset variables (#19921) - laf
  • Api device add display template (#19920) - laf
  • Rrdtool, ignore errors from libraries (#19907) - murrant
  • Make sure some variables are defined in the disk_bits/generic_data graphs to fix missing variable errors (#19831) - eskyuu
  • Fix GPS location not stored due to empty location name for Fortigate devices (#19827) - Palerm0
  • Raise satellites/satellites_used RRD max from 40 to 200 for multi-constellation receivers (#19655) - octalparrot

Refactor

Cleanup

Documentation

  • Updated Alert Template documentation to add warning (#20092) - laf
  • Update documentation - rrdcached and rrd cleanup (#19879) - Jannos-443

Translation

Tests

Misc

Internal Features

Dependencies

Breaking Changes

  • Validate port parsing script now lives in includes/ folder (PHP) – changes required for custom scripts.

Security Fixes

  • Security fix for VRF displayName XSS (laf)
  • Security fix for F5 file inclusion (laf)
  • Security fix for PeeringDB XSS (laf)
  • Security fix for Wireless edit page (laf)
  • Security fix for procedure URLs in alerts table (laf)
  • Security fix for Graph group and nfsen includes (laf)
  • Consistent escaping of URL helpers (murrant)
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track LibreNMS

Get notified when new releases ship.

Sign up free

About LibreNMS

Community-based GPL-licensed network monitoring system

All releases →

Related context

Beta — feedback welcome: [email protected]