{"id":"CVE-2026-80214","summary":"LibreNMS Virtualisation Discovery Module RCE","details":"LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server.","aliases":["GHSA-7hmq-j399-mqwf"],"modified":"2026-08-28T11:30:34.015573230Z","published":"2026-08-26T02:11:01.673Z","database_specific":{"cwe_ids":["CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80214.json","cna_assigner":"PRJBLK"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80214.json"},{"type":"ADVISORY","url":"https://github.com/librenms/librenms/security/advisories/GHSA-7hmq-j399-mqwf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80214"},{"type":"EVIDENCE","url":"https://projectblack.io/blog/librenms-authenticated-rce-26-5-0/#rce-by-command-line-injection-2641"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/librenms/librenms","events":[{"introduced":"c22b74d46b307979a5b6a28b1a3a54e68b3152c4"},{"fixed":"c770a7f16c945b316f192d61c89437010aba7f5a"}],"database_specific":{"extracted_events":[{"introduced":"23.10.0"},{"fixed":"26.4.1"}],"source":"AFFECTED_FIELD"}}],"versions":["26.4.0","26.3.1","26.3.0","26.2.0","26.1.0","25.12.0","25.11.0","25.10.0","25.9.0","25.8.0","25.7.0","25.6.0","25.5.0","25.4.0","25.3.0","25.2.0","25.1.0","24.12.0","24.11.0","24.10.1","24.10.0","24.9.1","24.9.0","24.8.0","24.7.0","24.6.0","24.5.0","24.4.1","24.4.0","24.3.0","24.2.0","24.1.0","23.11.0","23.10.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80214.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"}]}