Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 16 September 2026.

Which products and versions are affected?

github.com/komari-monitor/komari (Go) SEMVER:introduced=0,fixed=0.0.0-20260609084633-98122fa4d110; Komari-Monitor Komari <= 1.2.0.

Is there a fix for This vulnerability?

Yes. github.com/komari-monitor/komari (Go): upgrade to 0.0.0-20260609084633-98122fa4d110 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a network appliance.

Check whether you run github.com/komari-monitor/komari (Go) or Komari-Monitor Komari at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Komari management interface CSRF with missing SameSite attribute

Q: Is there a fix for This vulnerability?

Yes. github.com/komari-monitor/komari (Go): upgrade to 0.0.0-20260609084633-98122fa4d110 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected?

Check whether you run github.com/komari-monitor/komari (Go) or Komari-Monitor Komari at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: info · Published 2026-09-16

Komari is a server monitoring and client management platform. The administrative interface is vulnerable to cross-site request forgery attacks because session cookies lack SameSite and Secure attributes. An attacker can trick an authenticated administrator into visiting a malicious website to execute arbitrary commands on managed systems, disable security features, or delete monitoring data.

Technologies: github.com/komari-monitor/komari (Go). Vendors: Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 16 September 2026.
Which products and versions are affected?: github.com/komari-monitor/komari (Go) SEMVER:introduced=0,fixed=0.0.0-20260609084633-98122fa4d110; Komari-Monitor Komari <= 1.2.0.
Is there a fix for This vulnerability?: Yes. github.com/komari-monitor/komari (Go): upgrade to 0.0.0-20260609084633-98122fa4d110 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a network appliance.
Am I affected?: Check whether you run github.com/komari-monitor/komari (Go) or Komari-Monitor Komari at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/komari-monitor/komari (Go): upgrade to 0.0.0-20260609084633-98122fa4d110 or later
```
go get github.com/komari-monitor/komari@v0.0.0-20260609084633-98122fa4d110
```

Technical details

The session_token cookie is set without SameSite or Secure attributes, and all /api/admin/ endpoints rely solely on cookie-based authentication with no CSRF token validation. While modern browsers (Chrome 80+, Firefox 103+, Safari) default to SameSite=Lax and mitigate exploitation via cross-site HTML forms, the vulnerability remains exploitable through legacy browsers, man-in-the-middle attacks over HTTP, and same-origin XSS contexts. High-impact operations including arbitrary command execution, 2FA disabling, and configuration modification are reachable.

Affected products

komari-monitor Komari <= 1.2.0

Timeline

2026-06-20: disclosed
2026-06-09: patched: Release 1.2.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.