Executive brief
Nagios Core and Nagios XI are monitoring systems used to track the health and performance of IT infrastructure. Authenticated users can execute arbitrary commands on the monitoring server by exploiting unfiltered macro substitution in notification commands, potentially compromising the entire monitoring infrastructure and the systems it manages. This requires that notification commands reference specific macros in shell-reachable positions—a configuration present in some non-default setups.
Technical details
A command injection vulnerability exists in the notification macro substitution mechanism of Nagios Core and Nagios XI. When a notification command references the $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ macros in a shell-executed context (e.g., within backticks or command substitution), an authenticated UI user can inject arbitrary shell commands via the com_data parameter. The vulnerability requires both authenticated access to the Nagios UI and a non-default configuration where notification commands use these macros unsafely. An attacker can achieve remote code execution with the privileges of the nagios system user. Patches are available in Nagios Core 4.5.14 and Nagios XI 2026R1.7.
Affected products
- Nagios Enterprises Nagios Core before 4.5.14
- Nagios Enterprises Nagios XI before 2026R1.7
Timeline
- 2026-08-12: disclosed