CVE-2026-55182 — librenms/librenms
Fix: librenms/librenms@868e3b9CVE-2026-55182 is a CWE-77 vulnerability in librenms/librenms. A fix is available for librenms/librenms — see the affected versions and patch details below.
LibreNMS: Remote Code Execution by Signal Alert Transportation Module
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-55182.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
Real-World Exposure
librenms/librenmsReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Summary
A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands.
Details
The vulnerability is caused by an unsafe exec call in deliverAlert function of LibreNMS/Alert/Transport/Signal.php. Escapes for the path of signal-cli and the Recipient field are insufficient to prevent command-line injection.
The composer_wrapper.php under scripts is also vulnerable to command injection (unsafe exec calls) by passing the injected command as an argument, and it is accepting arguments passed by deliverAlert.
By chaining these unsafe exec calls, malicious admin user can execute any executables in the server's filesystem.
PoC
- Under Dashboard -> Alert -> Alert Transports
- Create a new Alert Transport entry.
a. Select
SignalasTransport type. b. Put../scripts/composer_wrapper.phpintoPath. c. Put the command to execute underRecipientwith;at the start and the end of string.
- . Click
Save Transport, and after the popup closed, clickTest Transportbutton underActionof the created Alert Transport entry.
- The command is executed. <img width="532" height="216" alt="image" src="https://github.com/user-attachments/assets/d595b0fe-10cc-4050-b4b9-d290b658689d" />
Impact
This vulnerability allows a malicious actor to achieve Remote Code Execution (RCE), potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.
Remediation Advice
Escape user inputs, and avoid passing them directly into exec function. (scripts/composer_wrapper.php)
Avoid setting executable paths directly in web interface. Instead, use a config value, and only allow setting executable paths by command line interface. (LibreNMS/Alert/Transport/Signal.php)
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | librenms/librenms | ≥ 21.6.0&&< 26.5.0 | 26.5.0composer require librenms/librenms:^26.5.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for librenms/librenms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update librenms/librenms to 26.5.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-55182 is resolved across your whole dependency graph.
Workarounds
Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.
Frequently Asked Questions
Is CVE-2026-55182 in your dependencies?
Find it across Packagist, including transitive dependencies.