Executive brief
Nagios Core and Nagios XI are open-source and commercial monitoring systems that track the health of IT infrastructure. A reflected cross-site scripting vulnerability in the cmd.cgi component allows an unauthenticated attacker to craft a malicious link that, when clicked by an authenticated administrator, executes arbitrary JavaScript in their browser. An attacker could steal session cookies, modify monitoring configurations, acknowledge false alerts, or perform other actions as the victim.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the cmd.cgi script, where user input via the NagFormId parameter is not properly sanitized before being reflected in the HTTP response. The attack is reflected (not stored) and requires social engineering to trick an authenticated user into clicking a malicious link. An unauthenticated attacker can craft a URL containing JavaScript payload in the NagFormId parameter; when a logged-in administrator visits the URL, the script executes in their session context. This allows the attacker to perform actions with the victim's privileges, such as modifying monitoring rules or exfiltrating session tokens. Patches are available in Nagios Core 4.5.14 and later, and Nagios XI 2026R1.7 and later.
Affected products
- Nagios Core before 4.5.14
- Nagios XI before 2026R1.7
Timeline
- 2026-08-12: disclosed: CVE-2026-48550 published
- 2026-08-12: patched: Fix available in Nagios Core 4.5.14 and Nagios XI 2026R1.7