CVE-2026-34189: CSRF in Event Response Deletion

Published Oct 1, 2026

Updated

Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.

Affected Software

1 affected component

Pandora FMS Pandora FMS>=777

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Pandora FMS to a version that resolves this vulnerability.
Fixed in 805
Upgrade
Upgrade Pandora FMS to a version that resolves this vulnerability.
Fixed in 800.5

Event History

Oct 1, 2026

CVE Published

via MITRE·09:24 AM

Data Sourced

via MITRE·09:24 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Pandora FMS deployments from version 777 onwards are affected when an administrator is authenticated in the application and can be induced to visit a malicious page.

What does an attacker need to exploit the vulnerability?

The attacker does not need prior authentication, but an authenticated administrator must visit a malicious page. Exploitation uses a forged GET request to trigger deletion of event responses.

What is the impact of successful exploitation?

A successful attack can delete event responses. The provided CVSS vector indicates high impact to integrity and low impact to availability, with no confidentiality impact.