---
id: 3715
title: "LibreNMS Authenticated RCE (< 26.5.0)"
source_domain: projectblack.io
source_url: "https://projectblack.io/blog/librenms-authenticated-rce-26-5-0/"
published_at: "2026-06-13 02:35"
tags: ["rce", "web-security", "command-injection", "librenms", "authenticated"]
phying_url: "https://phying.com/item/3715"
lang: en
---

# LibreNMS Authenticated RCE (< 26.5.0)

## Summary

The second LibreNMS post: an unsanitised exec call in the Libvirt discovery module allows authenticated RCE, plus alternative paths via writable binaries and composer wrapper argument injection.

## Intelligence Metadata

- **Sources:** projectblack.io
- **Published:** 2026-06-13 02:35
- **Original:** https://projectblack.io/blog/librenms-authenticated-rce-26-5-0/
- **Phying News:** https://phying.com/item/3715