CVE-2026-48549: Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie
Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allowing a cross-site request to execute Nagios commands as a currently authenticated user.
Affected Software
Event History
Frequently Asked Questions
Who can be affected by this issue?
Nagios Core versions before 4.5.13 and Nagios XI versions before 2026R1.5 are affected when a user is currently authenticated to the Nagios web interface.
What does an attacker need to exploit it?
The attacker does not need Nagios credentials, but must cause an authenticated user to submit a cross-site POST request. The request must omit the Cookie header and include matching NagFormId and nagFormId values in the POST body.
What is the impact of a successful attack?
A successful attack can execute Nagios commands with the permissions of the authenticated user. The stated impact is integrity loss, with no stated confidentiality or availability impact.