CVE-2026-6204

LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires administrative privileges. Exploitation could result in compromise of the underlying web server.

• CWE-78

• https://github.com/librenms/librenms/security/advisories/GHSA-pr3g-phhr-h8fhThird Party Advisory
• https://projectblack.io/blog/librenms-authenticated-rce-and-xss/#binary-path-rce-pocExploit, Third Party Advisory

Published

Apr 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61985Missing Authorization vulnerability in magepeopleteam Car Re…5.3
• CVE-2026-6199A vulnerability was found in Tenda F456 1.0.0.5. Impacted is…8.8
• CVE-2026-6200A vulnerability was determined in Tenda F456 1.0.0.5. The af…8.8
• CVE-2026-6201A vulnerability was identified in CodeAstro Online Job Porta…5.4
• CVE-2026-6202A security flaw has been discovered in code-projects Easy Bl…6.3
• CVE-2026-6203The User Registration & Membership plugin for WordPress is v…6.1
• CVE-2026-6206The MW WP Form plugin for WordPress is vulnerable to Informa…5.3
• CVE-2026-6207Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-6208Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-6209Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-6210A type confusion vulnerability in Qt SVG allows an attacker …8.7
• CVE-2026-6211Unrestricted upload of file with dangerous type vulnerabilit…8.7