Executive brief
Nagios Core and Nagios XI are monitoring systems used by organizations to track IT infrastructure health and performance. This vulnerability allows an attacker to bypass CSRF protections and execute commands in Nagios as a legitimate user, potentially leading to unauthorized configuration changes, service downtimes, or compromised monitoring data that could mask real infrastructure problems.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in cmd.cgi due to improper validation of the double-submit cookie protection mechanism. When no Cookie header is present in a request, the protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body. The vulnerability requires the victim to be already authenticated to Nagios, and the attacker must craft a malicious cross-site request that the authenticated user visits. A successful attack allows execution of arbitrary Nagios commands with the privileges of the authenticated user. Patches are available in Nagios Core 4.5.13 and later, and Nagios XI 2026R1.5 and later.
Affected products
- Nagios Enterprises Nagios Core before 4.5.13
- Nagios Enterprises Nagios XI before 2026R1.5
Timeline
- 2026-08-26: disclosed: Vulnerability published