CVE-2026-48552 Overview
CVE-2026-48552 is a DOM-based cross-site scripting (XSS) vulnerability affecting Nagios Core before version 4.5.14 and Nagios XI before 2026R1.7. The flaw resides in jsonquery.js, where unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization. An authenticated attacker with permission to store data in affected fields can inject JavaScript that executes in another user's browser session. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Successful exploitation allows arbitrary JavaScript execution in the victim's browser, enabling session hijacking, credential theft, and unauthorized actions against the Nagios monitoring interface.
Affected Products
- Nagios Core versions prior to 4.5.14
- Nagios XI versions prior to 2026R1.7
- The jsonquery.js client-side component in both products
Discovery Timeline
- 2026-08-12 - CVE-2026-48552 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-48552
Vulnerability Analysis
The vulnerability originates in jsonquery.js, a client-side JavaScript component used by the Nagios web interface to render JSON-encoded monitoring data. The script reads stored field values and inserts them directly into the Document Object Model without applying HTML encoding or output sanitization.
Because the sink writes to the DOM using string concatenation rather than safe assignment methods such as textContent, any attacker-controlled JSON string value is interpreted as HTML markup. Payloads containing <script> tags or event handlers such as onerror execute in the security context of the Nagios application. The attack requires user interaction, meaning a legitimate operator must load the page rendering the poisoned data.
Root Cause
The root cause is missing output encoding in the client-side rendering logic of jsonquery.js. Developers relied on the JSON transport layer to deliver structured data but did not treat the string values within that JSON as untrusted when writing them into the DOM. This design pattern violates the principle of contextual output encoding, which requires encoding at the point where data crosses into a new interpreter context.
Attack Vector
An attacker with low privileges submits a payload into a stored Nagios field that later flows through jsonquery.js. When a privileged user views the affected page, the malicious JSON value is fetched, deserialized, and written to the DOM. The browser then executes the injected script under the origin of the Nagios server. Consult the VulnCheck Advisory for Nagios Core XI for additional technical context.
Detection Methods for CVE-2026-48552
Indicators of Compromise
- Stored Nagios field values containing HTML tags such as <script>, <img>, or <svg> combined with event handlers like onerror or onload
- Unexpected outbound HTTP requests from operator browsers to attacker-controlled domains shortly after loading Nagios dashboards
- Anomalous session activity or configuration changes originating from administrator accounts that recently viewed pages backed by jsonquery.js
Detection Strategies
- Review Nagios web server access logs for POST requests that write payloads containing angle brackets, JavaScript URIs, or encoded script fragments into monitored objects
- Inspect stored configuration and comment fields for JSON values whose string content includes HTML control characters
- Correlate browser-based content security policy (CSP) violation reports with page loads referencing jsonquery.js
Monitoring Recommendations
- Enable browser-based CSP reporting on the Nagios frontend to surface script-source violations tied to DOM-based injection attempts
- Monitor authentication and privileged-action audit logs for actions performed within seconds of loading affected dashboards
- Alert on modifications to Nagios objects submitted by low-privileged accounts that contain markup or scripting characters
How to Mitigate CVE-2026-48552
Immediate Actions Required
- Upgrade Nagios Core to version 4.5.14 or later, and Nagios XI to 2026R1.7 or later
- Audit all stored fields consumed by jsonquery.js and remove any values containing HTML or script content
- Rotate session cookies and administrator credentials if evidence suggests operators viewed poisoned pages
Patch Information
Fixes are available in Nagios Core 4.5.14 and Nagios XI 2026R1.7. Review the GitHub Changelog for NagiosCore and the Nagios Security Disclosures page for release notes and upgrade instructions.
Workarounds
- Restrict write access to Nagios objects so that only trusted administrators can populate fields rendered by jsonquery.js
- Deploy a strict Content Security Policy that disallows inline script execution on the Nagios web interface
- Place the Nagios web interface behind a web application firewall (WAF) rule set that inspects and blocks HTML markup in stored monitoring fields
# Example Content-Security-Policy header for the Nagios web frontend
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
