CVE-2026-48548: Nagios Core CSRF via cmd.cgi
Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently authenticated user without their knowledge or consent.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Nagios Core versions before 4.5.12 are affected. Exploitation targets the cmd.cgi endpoint and requires a user to be currently authenticated to Nagios Core.
What must an attacker do to exploit this issue?
An attacker must cause an authenticated Nagios user to submit a malicious cross-site POST request. The request can execute Nagios commands with that user's privileges when the NagFormId cookie is absent.
Are unauthenticated attackers able to execute commands directly?
No. The attacker does not need Nagios credentials, but exploitation relies on a currently authenticated user and executes commands as that user.
How can administrators determine whether they may be vulnerable?
Check the deployed Nagios Core version. Versions earlier than 4.5.12 should be considered affected, particularly where users can access Nagios while browsing untrusted content.