CVE-2026-48551
Received Received - Intake

CSRF Bypass in Nagios Core and Nagios XI

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: VulnCheck

Description
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run commands as authorized users via malicious links.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-48551
EUVD
EUVD-2026-57326

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nagios nagios_core to 4.5.14 (exc)
nagios nagios_xi to 2026R1.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 have a CSRF protection bypass flaw. Attackers can bypass CSRF protections by providing matching cookie and request parameter values. This allows unauthenticated attackers to run commands as authorized users via malicious links.

Detection Guidance

To detect this vulnerability, check the versions of Nagios Core and Nagios XI running on your systems. Compare them against the affected versions (Nagios Core before 4.5.14 and Nagios XI before 2026R1.7). Use commands like 'nagios -v /usr/local/nagios/etc/nagios.cfg' for Core or check the XI admin panel for version details.

Impact Analysis

Unauthenticated attackers could execute unauthorized commands on your Nagios system as if they were a legitimate user. This could lead to system compromise, data manipulation, or disruption of monitoring services.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's integrity and confidentiality requirements and HIPAA's access controls. Compliance may be compromised if systems are not patched.

Mitigation Strategies

Immediately update Nagios Core to version 4.5.14 or later and Nagios XI to version 2026R1.7 or later. If immediate updates are not possible, restrict network access to Nagios interfaces and disable unnecessary user privileges as a temporary measure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48551. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart