CVE-2026-48553: Nagios Core/XI RCE Vulnerability

CVE-2026-48553 Overview

CVE-2026-48553 is an authenticated remote code execution vulnerability affecting Nagios Core before 4.5.13 and Nagios XI before 2026R1.5. The flaw exists in the Nagios Remote Data Processor (NRDP) and stems from unsafe handling of custom-variable macros. An authenticated attacker with NRDP access can inject operating system commands through a custom variable value when that variable is referenced in a shell-executed command line. The vulnerability is classified as OS Command Injection [CWE-78]. Exploitation depends on a non-default configuration where a custom variable is defined on a host, service, or contact and referenced in a shell-executed command.

Critical Impact
An authenticated NRDP user can achieve remote code execution on the Nagios server, leading to full compromise of monitoring infrastructure and any credentials it stores.

Affected Products

Nagios Core versions prior to 4.5.13
Nagios XI versions prior to 2026R1.5
Deployments using Nagios Remote Data Processor (NRDP) with custom variables referenced in shell commands

Discovery Timeline

2026-08-12 - CVE-2026-48553 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-48553

Vulnerability Analysis

Nagios Core supports custom variables that administrators can attach to hosts, services, and contacts. These variables are expanded into macros at runtime and can be referenced inside command definitions. When such a command is executed through a shell, the macro value is interpolated directly into the command line without adequate sanitization.

An authenticated attacker with access to the NRDP endpoint can submit data that overrides or supplies the custom-variable value. Because the value flows into a shell-executed command, embedded shell metacharacters such as backticks, semicolons, and command substitution constructs are interpreted by the shell rather than treated as literal text. This results in arbitrary OS command execution under the account running the Nagios process.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. Nagios expands custom-variable macros into the command string before invoking a shell, without escaping or quoting the value. Trust is placed in the macro source, but NRDP allows authenticated clients to influence that source.

Attack Vector

Exploitation is network-based and requires valid NRDP credentials. The attacker submits a crafted payload to the NRDP endpoint that populates or updates a custom variable referenced by a shell-executed command. When Nagios processes the corresponding host, service, or contact event, the shell parses the injected metacharacters and executes attacker-controlled commands. See the VulnCheck Advisory: Nagios XI RCE for additional technical detail.

Detection Methods for CVE-2026-48553

Indicators of Compromise

Unexpected child processes spawned by the nagios process, particularly shells (sh, bash), interpreters (python, perl), or network utilities (curl, wget, nc)
NRDP requests containing shell metacharacters such as `, $(, ;, |, or && inside custom-variable fields
Modifications to host, service, or contact definitions that introduce or change _-prefixed custom variables outside normal change windows
Outbound network connections from the Nagios server to previously unseen destinations

Detection Strategies

Monitor process ancestry to identify shell or interpreter processes descending from nagios or plugin execution paths
Inspect NRDP HTTP request bodies for command-injection patterns in variable values
Audit Nagios configuration files for custom variables referenced within shell-executed command definitions

Monitoring Recommendations

Enable command-line auditing (auditd on Linux) for processes spawned by the Nagios service account
Forward Nagios access logs, NRDP submission logs, and host process telemetry to a centralized analytics platform for correlation
Alert on authentication events to NRDP from unexpected source addresses or service accounts

How to Mitigate CVE-2026-48553

Immediate Actions Required

Upgrade Nagios Core to version 4.5.13 or later and Nagios XI to 2026R1.5 or later
Restrict network access to NRDP endpoints to trusted management hosts only
Rotate NRDP tokens and credentials, especially for any accounts with configuration privileges
Review all host, service, and contact definitions for custom variables that feed into shell-executed commands

Patch Information

Nagios has released fixed builds addressing the macro-injection flaw. Refer to the GitHub Nagios Core Changelog and the Nagios Security Disclosures page for release notes and download locations. Apply the vendor-supplied packages and restart the Nagios service to activate the fix.

Workarounds

Remove or refactor command definitions that expand custom-variable macros directly into shell command lines
Where custom variables must be used, wrap plugin invocations so that values are passed as separate arguments rather than concatenated into shell strings
Disable NRDP if it is not required, or place it behind a mutually authenticated reverse proxy with strict IP allowlisting
Run the Nagios process under a least-privilege account with no interactive shell and limited filesystem access

bash

# Example: restrict NRDP access at the web server layer (Apache)
<Location "/nrdp/">
    Require ip 10.0.0.0/24
    Require ip 192.168.10.5
</Location>

# Verify installed Nagios Core version after patching
/usr/local/nagios/bin/nagios --version