Executive brief
Nagios Core and Nagios XI are monitoring and management systems used to track the health and performance of IT infrastructure. A weakness in their cross-site request forgery (CSRF) protection allows attackers to trick authorized users into performing unauthorized actions via specially crafted links. An unauthenticated attacker can exploit this to execute monitoring commands or administrative actions as the logged-in user without their knowledge.
Technical details
This vulnerability is a CSRF protection bypass in the double-submit cookie mechanism used by Nagios Core and XI. The vulnerability allows an attacker to supply matching cookie and request parameter values to bypass CSRF validation, which is intended to prevent unauthorized state-changing requests from external sites. The attack requires no authentication and can be delivered via a malicious link that a logged-in Nagios user clicks, enabling command execution with the privileges of that user. Nagios Core 4.5.14 and Nagios XI 2026R1.7 or later contain fixes for this issue.
Affected products
- Nagios Enterprises Nagios Core before 4.5.14
- Nagios Enterprises Nagios XI before 2026R1.7
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: Nagios Core 4.5.14 and Nagios XI 2026R1.7 contain fixes