Nagios XI versions prior to 2024R1.2.2 have a host header injection vulnerability. This flaw allows an unauthenticated remote attacker to supply a malicious Host header, which the application uses without sufficient validation when generating absolute URLs. Exploitation can lead to phishing, hijacking of account recovery links, and web cache poisoning.