CVE-2026-48549: Nagios Core and XI CSRF Vulnerability

CVE-2026-48549 Overview

CVE-2026-48549 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Nagios Core and Nagios XI. The flaw resides in cmd.cgi and affects Nagios Core before 4.5.13 and Nagios XI before 2026R1.5. The application implements double-submit cookie protection to prevent CSRF, but the check can be bypassed when no Cookie header is present. An attacker who supplies matching NagFormId and nagFormId values in the POST body satisfies the token comparison. A cross-site request can then execute Nagios commands in the context of an authenticated user.

Critical Impact
A remote attacker can execute arbitrary Nagios commands as any authenticated user who visits an attacker-controlled page, enabling unauthorized changes to monitoring state and command execution.

Affected Products

Nagios Core versions before 4.5.13
Nagios XI versions before 2026R1.5
Deployments exposing cmd.cgi to authenticated web users

Discovery Timeline

2026-08-26 - CVE-2026-48549 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-48549

Vulnerability Analysis

Nagios Core uses a double-submit cookie pattern to defend cmd.cgi against CSRF. The server compares a token stored in a cookie against a token submitted in the request body. If both values match, the request is treated as legitimate. The vulnerable implementation fails to enforce the presence of the cookie half of the pair. When the incoming request contains no Cookie header, the comparison logic still evaluates as successful if the body carries two matching parameters, NagFormId and nagFormId.

An attacker can host a page that submits a cross-origin POST to cmd.cgi with both parameter names set to any identical value. Browsers issuing cross-site POSTs can be induced to omit the session cookie under certain SameSite configurations, or the attacker can craft the request path so the token comparison passes on body values alone.

Root Cause

The root cause is missing validation that the CSRF token cookie exists and is non-empty before performing the double-submit comparison. The check compares two attacker-controllable POST parameters when the cookie is absent, converting the defense into a self-satisfying condition.

Attack Vector

Exploitation requires an authenticated Nagios user to visit an attacker-controlled web page. The page issues a cross-origin POST to cmd.cgi with matching NagFormId and nagFormId body parameters and a valid Nagios command payload. The server processes the command with the victim's privileges, allowing unauthorized modification of monitoring configuration, host and service acknowledgments, notifications, or arbitrary command scheduling supported by cmd.cgi.

No synthetic proof-of-concept is reproduced here. Refer to the VulnCheck Advisory: Nagios Core XI CSRF for technical details.

Detection Methods for CVE-2026-48549

Indicators of Compromise

POST requests to cmd.cgi that contain NagFormId and nagFormId body parameters but lack a Cookie header.
Unexpected Nagios command submissions correlated with user browsing activity to external sites.
External Referer or Origin headers on requests to cmd.cgi that do not match the Nagios web interface hostname.

Detection Strategies

Inspect web server access logs for cmd.cgi POSTs missing the session cookie and flag them for review.
Alert on any successful command execution in nagios.log that follows a request with an off-origin Referer.
Deploy a WAF rule that rejects POSTs to cmd.cgi when the Cookie header is absent.

Monitoring Recommendations

Enable verbose CGI request logging on the Nagios web front end and forward logs to a central analytics platform.
Monitor for spikes in acknowledgment, downtime, or external command submissions outside normal operator hours.
Correlate Nagios command events with authentication logs to identify commands issued during suspicious sessions.

How to Mitigate CVE-2026-48549

Immediate Actions Required

Upgrade Nagios Core to version 4.5.13 or later.
Upgrade Nagios XI to version 2026R1.5 or later.
Restrict access to cmd.cgi to trusted management networks using firewall or reverse-proxy rules.
Enforce short web session lifetimes and require re-authentication for command submissions.

Patch Information

Fixed releases are available from the vendor. Review the GitHub Nagios Core Changelog and the Nagios Security Disclosures page for release notes and upgrade instructions.

Workarounds

Place the Nagios web interface behind a reverse proxy that rejects POSTs to cmd.cgi lacking a session cookie or a same-origin Referer header.
Configure session cookies with SameSite=Strict to reduce cross-site POST exposure.
Require VPN or IP allowlisting for access to the Nagios administrative interface until patches are applied.

bash

# Example nginx snippet to block cookieless POSTs to cmd.cgi
location = /nagios/cgi-bin/cmd.cgi {
    if ($request_method = POST) {
        if ($http_cookie = "") { return 403; }
    }
    proxy_pass http://nagios_backend;
}