Executive brief
Nagios Core is an open-source infrastructure monitoring system used to track the health and performance of IT systems. A flaw in the CSRF protection mechanism allows attackers to craft malicious web requests that execute arbitrary monitoring commands—such as acknowledging alerts, disabling checks, or restarting services—as a logged-in administrator without their knowledge, potentially disrupting monitoring operations.
Technical details
The vulnerability is a cross-site request forgery (CSRF) flaw in the cmd.cgi component of Nagios Core. The CSRF protection mechanism relies on a NagFormId cookie; however, validation passes when this cookie is absent, allowing attackers to bypass the protection entirely. An attacker can craft a malicious POST request and trick an authenticated Nagios user (via phishing or a compromised website) into triggering it. If successful, the attacker can execute arbitrary Nagios commands in the context of the victim's session, such as modifying service checks, acknowledging problems, or changing configuration. The vulnerability requires an authenticated user to be actively logged into Nagios and affects versions before 4.5.12; patches are available in version 4.5.12 and later.
Affected products
- Nagios Enterprises Nagios Core before 4.5.12
Timeline
- 2026-08-26: disclosed