CVE-2026-48554: Nagios Core & XI RCE Vulnerability

CVE-2026-48554 Overview

CVE-2026-48554 is an authenticated remote code execution vulnerability in Nagios Core before 4.5.14 and Nagios XI before 2026R1.7. The flaw resides in the notification subsystem, where the com_data parameter feeds unfiltered content into NOTIFICATION-family macros such as $NOTIFICATIONCOMMENT$ and $NOTIFICATIONAUTHOR$. When these macros are referenced in a shell-reachable position of a notification command, authenticated UI users can inject shell metacharacters and run arbitrary commands as the nagios user. The issue is classified as OS Command Injection [CWE-78].

Critical Impact
Authenticated Nagios users can achieve remote code execution as the nagios service account on hosts running vulnerable, non-default notification configurations.

Affected Products

Nagios Core versions prior to 4.5.14
Nagios XI versions prior to 2026R1.7
Deployments referencing $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in shell-executed notification commands

Discovery Timeline

2026-08-12 - CVE-2026-48554 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-48554

Vulnerability Analysis

Nagios notification commands expand a family of macros before dispatching a shell command line. The com_data request parameter populates the notification comment and author fields that back the $NOTIFICATIONCOMMENT$ and $NOTIFICATIONAUTHOR$ macros. Nagios does not sanitize this input for shell metacharacters before substitution. When an administrator has defined a notification command that references either macro in a position reachable by the shell, the substituted value is interpreted as command syntax rather than data.

An authenticated user with permission to submit comments or trigger notifications through the web UI can supply payloads containing backticks, $(...) command substitution, or shell separators. The Nagios process concatenates the input into the command string and passes it to /bin/sh, executing attacker-controlled commands under the nagios account. That account typically owns configuration files, plugins, and the event pipeline, which enables persistence and lateral movement into monitored infrastructure.

Root Cause

The root cause is missing output encoding of user-controlled macro values before shell expansion. Nagios treats macros as trusted format tokens even though several NOTIFICATION-family values originate from untrusted UI input.

Attack Vector

Exploitation requires an authenticated session and a non-default configuration in which a notification command references the vulnerable macros in a shell-executed argument. The attacker submits a comment or notification containing shell metacharacters through the com_data parameter. When Nagios fires the notification, the payload is expanded into the command line and executed. See the VulnCheck advisory for Nagios Core XI for the full technical breakdown.

Detection Methods for CVE-2026-48554

Indicators of Compromise

Notification comments or author fields containing shell metacharacters such as backticks, $(, ;, |, or &&.
Child processes of the Nagios daemon or notification helper scripts spawning shells, network utilities, or interpreters like bash, sh, curl, wget, nc, python, or perl.
Unexpected outbound network connections initiated by the nagios user account.
New or modified files under the nagios home directory, plugin directories, or cron entries owned by nagios.

Detection Strategies

Audit nagios.log and web UI submission logs for com_data values containing shell metacharacters.
Correlate notification dispatch events with process execution telemetry for the nagios account.
Alert on any authenticated session that both edits notification commands and submits comments in a short window.

Monitoring Recommendations

Enable process command-line logging on Nagios servers and forward to a central analytics platform.
Baseline the set of binaries normally invoked by notification commands and alert on deviations.
Monitor changes to commands.cfg and any file referencing $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$.

How to Mitigate CVE-2026-48554

Immediate Actions Required

Upgrade Nagios Core to 4.5.14 or later and Nagios XI to 2026R1.7 or later.
Review every notification command definition and remove references to $NOTIFICATIONCOMMENT$ and $NOTIFICATIONAUTHOR$ from shell-reachable positions until patched.
Restrict UI accounts authorized to submit comments or trigger notifications to trusted administrators.
Rotate credentials and inspect the nagios account for signs of post-exploitation activity.

Patch Information

Fixes are documented in the Nagios Core changelog on GitHub and in the Nagios security disclosures portal. Apply vendor-supplied packages for Nagios Core 4.5.14 and Nagios XI 2026R1.7.

Workarounds

Rewrite notification commands to pass macro values through environment variables or stdin instead of argv, avoiding shell interpolation.
Wrap notification helpers so that arguments are quoted with printf %q or an equivalent before invocation.
Temporarily disable notification commands that reference the vulnerable macros until the upgrade is complete.
Place Nagios web interfaces behind a reverse proxy that enforces per-user rate limits and blocks comment payloads containing shell metacharacters.

bash

# Example: sanitize a notification command by passing macro data via environment variable
# Vulnerable pattern (do not use):
#   /usr/local/nagios/libexec/notify.sh "$NOTIFICATIONCOMMENT$" "$NOTIFICATIONAUTHOR$"
#
# Safer pattern: expose macros as environment variables and let the script read them
define command {
    command_name    notify-by-email-safe
    command_line    /usr/bin/env \
                    NAGIOS_COMMENT="$NOTIFICATIONCOMMENT$" \
                    NAGIOS_AUTHOR="$NOTIFICATIONAUTHOR$" \
                    /usr/local/nagios/libexec/notify.sh
}