# CVE-2026-48548: Nagios Core CSRF bypass in cmd.cgi

Source: https://junglewise.ai/threats/cve-2026-48548-nagios-core-csrf-bypass-in-cmd-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-48548 · Severity: medium · CVSS 6.5 · Published 2026-08-26

Nagios Core is an open-source infrastructure monitoring system used to track the health and performance of IT systems. A flaw in the CSRF protection mechanism allows attackers to craft malicious web requests that execute arbitrary monitoring commands—such as acknowledging alerts, disabling checks, or restarting services—as a logged-in administrator without their knowledge, potentially disrupting monitoring operations.

Technologies: [Nagios Enterprises Nagios Core](https://junglewise.ai/threats/technologies/nagios-core). Vendors: [Nagios Enterprises](https://junglewise.ai/threats/vendors/nagios-enterprises).

## Quick answers

**Is CVE-2026-48548 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48548 being exploited in the wild.

**How severe is CVE-2026-48548?** Medium severity, with a CVSS score of 6.5, published 26 August 2026.

**Which products and versions are affected?** Nagios Enterprises Nagios Core before 4.5.12.

**Is there a fix for CVE-2026-48548?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48548 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-48548?** Check whether you run Nagios Enterprises Nagios Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cross-site request forgery (CSRF) flaw in the cmd.cgi component of Nagios Core. The CSRF protection mechanism relies on a NagFormId cookie; however, validation passes when this cookie is absent, allowing attackers to bypass the protection entirely. An attacker can craft a malicious POST request and trick an authenticated Nagios user (via phishing or a compromised website) into triggering it. If successful, the attacker can execute arbitrary Nagios commands in the context of the victim's session, such as modifying service checks, acknowledging problems, or changing configuration. The vulnerability requires an authenticated user to be actively logged into Nagios and affects versions before 4.5.12; patches are available in version 4.5.12 and later.

## Affected products

- Nagios Enterprises Nagios Core before 4.5.12

## Timeline

- 2026-08-26: disclosed

## References

- [https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog](https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog)
- [https://www.nagios.com/security-disclosures/nagios-core/](https://www.nagios.com/security-disclosures/nagios-core/)

## Related threats

- [Nagios Core CSRF vulnerability in cmd.cgi](https://junglewise.ai/threats/cve-2026-48549-nagios-core-csrf-vulnerability-in-cmd-cgi)
- [Nagios Core and XI authenticated remote code execution in notification macros](https://junglewise.ai/threats/cve-2026-48554-nagios-core-and-xi-authenticated-remote-code-execution-in)
- [Nagios Core authenticated remote code execution via custom-variable macro injection](https://junglewise.ai/threats/cve-2026-48553-nagios-core-authenticated-remote-code-execution-via-custom)
- [Nagios Core DOM-based XSS in jsonquery.js](https://junglewise.ai/threats/cve-2026-48552-nagios-core-dom-based-xss-in-jsonquery-js)
- [Nagios Core and XI CSRF protection bypass via double-submit cookie](https://junglewise.ai/threats/cve-2026-48551-nagios-core-and-xi-csrf-protection-bypass-via-double-submit)