CVE-2026-48549
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contain a CSRF vulnerability in cmd.cgi. The double-submit cookie protection can be bypassed when no Cookie header is present by supplying matching NagFormId and nagFormId values in the POST body.
Risk Assessment
An attacker can execute arbitrary Nagios commands as an authenticated user, potentially leading to unauthorized changes in monitoring configuration.
Recommendation
Update Nagios Core to version 4.5.13 or later and Nagios XI to version 2026R1.5 or later.
Other vulnerabilities in Nagios
See all- CVE-2016-10089High
Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file.
- CVE-2026-48548Medium
Nagios Core before 4.5.12 contains a CSRF vulnerability in cmd.cgi where the CSRF protection passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as an authenticated user.
Original NVD description (English source)
Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allowing a cross-site request to execute Nagios commands as a currently authenticated user.