CVE-2026-48551
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run commands as authorized users via malicious links.
Risk Assessment
The risk for the organization is the possibility of unauthorized actions in the Nagios interface by an unauthenticated attacker, which can lead to configuration and data integrity compromise.
Recommendation
It is recommended to upgrade Nagios Core to version 4.5.14 or later and Nagios XI to version 2026R1.7 or later. Additionally, educate users about the risk of clicking suspicious links.
Original NVD description (English source)
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run commands as authorized users via malicious links.