CVE-2026-34190: Pandora FMS CSRF Vulnerability

CVE-2026-34190 Overview

CVE-2026-34190 is a Cross-Site Request Forgery (CSRF) vulnerability in Pandora FMS that enables unauthorized deletion of alert commands. The flaw affects Pandora FMS versions 777 and later. An attacker can trigger sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. Successful exploitation removes alert commands from the monitoring configuration, degrading detection and notification capabilities. The weakness is tracked as CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker-controlled web page can silently delete alert commands in Pandora FMS when an authenticated administrator browses it, disrupting monitoring and incident notification workflows.

Affected Products

Pandora FMS version 777
Pandora FMS versions after 777
Deployments where administrators maintain active browser sessions to the Pandora FMS console

Discovery Timeline

2026-10-01 - CVE-2026-34190 published to the National Vulnerability Database (NVD)
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-34190

Vulnerability Analysis

The vulnerability resides in the alert command management endpoints of Pandora FMS. These endpoints accept GET requests for deletion actions without validating a CSRF token or verifying the request origin. Any authenticated administrator session can be leveraged by an attacker-controlled page to issue these requests on the user's behalf.

Because the operation is performed through sequential GET requests, an attacker can chain multiple deletions through simple HTML elements such as <img> tags or hidden iframes. No direct interaction with the Pandora FMS interface is required beyond the victim visiting the malicious page.

The impact is limited to integrity of the alert command configuration. Removed alert commands can prevent downstream notifications, scripts, and automated response actions tied to monitored events from executing.

Root Cause

The root cause is the absence of anti-CSRF protections on state-changing endpoints that handle alert command deletion. The server trusts the browser session cookie without requiring a synchronizer token, SameSite cookie enforcement, or validation of the Origin/Referer header, which is the pattern described in CWE-352.

Attack Vector

Exploitation requires an authenticated Pandora FMS administrator to visit a page controlled by the attacker while holding a valid session. The page issues cross-origin GET requests to the alert command deletion endpoints, which the browser transmits with the administrator's session cookie. The attack vector is network-based and relies on user interaction, consistent with the published CVSS vector.

The vulnerability does not require prior authentication by the attacker, no credentials or tokens need to be stolen, and no code execution is required on the victim host. The attacker only needs to lure an administrator to a crafted URL or embed the payload in a page the administrator will view.

See the Pandora FMS Vulnerabilities Overview for vendor-published details.

Detection Methods for CVE-2026-34190

Indicators of Compromise

Unexpected deletion events for alert commands recorded in the Pandora FMS audit log
HTTP GET requests to alert command deletion endpoints with external Referer headers
Administrator sessions issuing deletion requests immediately after visiting third-party sites
Sudden drops in alert notification volume without a corresponding configuration change ticket

Detection Strategies

Review Pandora FMS audit logs for delete actions targeting alert commands and correlate with the acting user and source IP
Deploy web application firewall (WAF) rules that inspect Referer and Origin headers on alert management endpoints
Alert on administrator-initiated configuration deletions that occur outside of change-management windows

Monitoring Recommendations

Forward Pandora FMS web server access logs and application audit logs to a centralized SIEM for correlation
Baseline normal alert command configuration counts and alert on unexpected decreases
Monitor administrator browser telemetry for navigation to untrusted domains during active console sessions

How to Mitigate CVE-2026-34190

Immediate Actions Required

Restrict Pandora FMS console access to trusted management networks or VPN segments
Require administrators to use dedicated browsers or browser profiles for Pandora FMS sessions
Terminate idle administrator sessions and shorten session cookie lifetimes
Audit alert command inventories and back up current configurations to allow rapid restoration

Patch Information

No fixed version is listed in the NVD record at the time of publication. Consult the Pandora FMS Vulnerabilities Overview for official patch availability and apply updates as soon as the vendor publishes a fixed release for versions 777 and later.

Workarounds

Enforce SameSite=Strict or SameSite=Lax on Pandora FMS session cookies at the reverse proxy layer
Configure the reverse proxy to reject requests to alert management endpoints when the Origin or Referer header does not match the Pandora FMS hostname
Separate administrative duties so that daily browsing and Pandora FMS administration do not share the same browser session

bash

# Example nginx snippet to block cross-origin requests to alert management endpoints
location ~* /pandora_console/.*alert.*command.* {
    if ($http_referer !~* "^https?://pandora\.example\.com/") {
        return 403;
    }
    proxy_pass http://pandora_backend;
}