CVE-2026-48548
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Nagios Core before 4.5.12 contains a CSRF vulnerability in cmd.cgi where the CSRF protection passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as an authenticated user.
Risk Assessment
The risk includes unauthorized execution of Nagios commands, potentially leading to disruption of monitoring or configuration changes.
Recommendation
Update Nagios Core to version 4.5.12 or later, which fixes this vulnerability.
Other vulnerabilities in Nagios
See all- CVE-2016-10089High
Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file.
- CVE-2026-48549Medium
Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contain a CSRF vulnerability in cmd.cgi. The double-submit cookie protection can be bypassed when no Cookie header is present by supplying matching NagFormId and nagFormId values in the POST body.
Original NVD description (English source)
Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently authenticated user without their knowledge or consent.