Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 8.8, published 9 September 2026.

Which products and versions are affected?

github.com/komari-monitor/komari (Go) < 0.0.0-20260609084633-98122fa4d110; Komari Monitor < 0.0.0-20260609084633-98122fa4d110.

Is there a fix for This vulnerability?

A patch was published on 2026-06-09: Patch released in version 0.0.0-20260609084633-98122fa4d110 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run github.com/komari-monitor/komari (Go) or Komari Monitor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Komari management interface CSRF

Q: Is there a fix for This vulnerability?

A patch was published on 2026-06-09: Patch released in version 0.0.0-20260609084633-98122fa4d110 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a web application.

Q: Am I affected?

Check whether you run github.com/komari-monitor/komari (Go) or Komari Monitor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · CVSS 8.8 · Published 2026-09-09

Komari is a monitoring platform used to manage and execute tasks on remote nodes. Its administrative interface lacks cross-site request forgery (CSRF) protection, meaning an attacker can trick an authenticated administrator into performing unauthorized actions such as executing shell commands on managed nodes, disabling two-factor authentication, or clearing monitoring records. While modern browsers block such attacks by default, the vulnerability remains exploitable in older browsers or if the administrator is already compromised by XSS malware.

Technologies: github.com/komari-monitor/komari (Go). Vendors: Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 8.8, published 9 September 2026.
Which products and versions are affected?: github.com/komari-monitor/komari (Go) < 0.0.0-20260609084633-98122fa4d110; Komari Monitor < 0.0.0-20260609084633-98122fa4d110.
Is there a fix for This vulnerability?: A patch was published on 2026-06-09: Patch released in version 0.0.0-20260609084633-98122fa4d110 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run github.com/komari-monitor/komari (Go) or Komari Monitor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a cross-site request forgery (CSRF) vulnerability affecting all /api/admin/ endpoints in Komari. The root cause is twofold: (1) the session_token cookie is set without the SameSite or Secure attributes (login.go:68), and (2) all admin endpoints rely solely on this cookie for authentication with no CSRF token validation or Origin checks. An attacker can craft a malicious webpage that, when visited by an authenticated administrator, submits state-changing requests (POST to /api/admin/task/exec, /api/admin/2fa/disable, /api/admin/settings/, etc.). In modern browsers (Chrome 80+, Firefox 103+, Safari), cookies without an explicit SameSite attribute default to SameSite=Lax, blocking cross-site POST cookies and mitigating the attack. However, the vulnerability remains exploitable in legacy browsers (<Chrome 80), within the same-origin context (via XSS or console access), or over HTTP (where Secure=false). The patched version (0.0.0-20260609084633-98122fa4d110) fixes the vulnerability.

Affected products

Komari Monitor Komari < 0.0.0-20260609084633-98122fa4d110

Timeline

2026-06-20: disclosed: Published to GitHub Advisory Database
2026-06-09: patched: Patch released in version 0.0.0-20260609084633-98122fa4d110
2026-09-09: advisory: Advisory updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.