CVE-2026-48551 describes a CSRF protection bypass in Nagios Core and Nagios XI. The flaw arises because the application accepts a self-supplied double-submit cookie, allowing an attacker to provide matching cookie and request parameter values to circumvent CSRF defenses. This enables unauthenticated attackers to perform actions with the privileges of authorized users by tricking them into clicking malicious links. The vulnerability affects versions prior to 4.5.14 for Nagios Core and prior to 2026R1.7 for Nagios XI. No official remediation or patch information is provided in the available data.

An attacker can bypass CSRF protections and execute commands as an authorized user without authentication. This could lead to unauthorized command execution within the affected Nagios installations, potentially compromising system integrity or availability. The impact is rated medium based on the CVSS score of 6.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted links and consider additional protective measures such as network-level restrictions or enhanced user interaction confirmations to mitigate risk.