CVE-2026-48549: Cross-Site Request Forgery (CSRF) in Nagios Enterprises, LLC. Nagios Core
Description
Nagios Core before version 4.5.13 and Nagios XI before 2026R1.5 contain a Cross-Site Request Forgery (CSRF) vulnerability in the cmd.cgi component. This vulnerability allows an attacker to bypass the double-submit cookie protection when no Cookie header is present by supplying matching NagFormId and nagFormId values in the POST body. Exploitation could enable execution of Nagios commands as an authenticated user.
CVSS v4.0
Score 6.9medium
Affected software
Nagios Enterprises, LLC.
Nagios Core
Nagios Enterprises, LLC.
Nagios XI
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-48549 is a CSRF vulnerability affecting Nagios Core prior to 4.5.13 and Nagios XI prior to 2026R1.5. The flaw exists in cmd.cgi where the double-submit cookie protection mechanism can be bypassed if the request lacks a Cookie header but includes matching NagFormId and nagFormId parameters in the POST body. This bypass allows a cross-site request to execute commands with the privileges of the currently authenticated user.
Potential Impact
An attacker can perform unauthorized Nagios commands by exploiting this CSRF vulnerability, potentially leading to unauthorized actions within the Nagios environment under the context of an authenticated user. The CVSS 4.0 base score is 6.9 (medium severity), indicating a moderate risk without requiring privileges or user interaction beyond visiting a malicious page.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a fix is available, users should consider mitigating CSRF risks by restricting access to Nagios interfaces, using network-level protections, or other compensating controls as recommended by the vendor once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-05-21T18:34:46.418Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8f0bdbacd9273b4917dece
Added to database: 08/26/2026, 15:52:59 UTC
Last enriched: 09/10/2026, 10:24:54 UTC
Last updated: 10/10/2026, 18:48:20 UTC
Views: 55
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.