CVE-2026-48551

medium

Description

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run commands as authorized users via malicious links.

References

https://www.vulncheck.com/advisories/nagios-core-xi-csrf-protection-bypass-via-double-submit-cookie

https://www.nagios.com/security-disclosures/nagios-core/

https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog

Details

Source: Mitre, NVD

Published: 2026-08-12

Updated: 2026-08-12

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

Severity: High

CVSS v3

Base Score: 7.4

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Severity: High

CVSS v4

Base Score: 6.1

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

Severity: Medium