Description

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim's browser.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-12T17:17:27.190Z",
  "pubdate": "2026-08-12T17:17:27.190Z",
  "executiveSummary": "A reflected cross-site scripting vulnerability exists within Nagios Core before 4.5.14 and Nagios XI before 2026R1.7. The flaw resides in the processing of user-supplied input via the NagFormId parameter within the vulnerable binary file cmd.cgi. This security deficiency allows unauthenticated remote threat actors to formulate malicious URLs embedded with arbitrary JavaScript payloads. When an authenticated administrative or privileged user interacts with the crafted link, the malicious script is rendered and executed within the context of the victim's active browser session. The primary risk implication includes unauthorized execution of client-side code, potential session hijacking, data exfiltration, and unauthorized administrative actions performed on behalf of the victim. Exploitation requires no prior authentication to stage the attack vector, but relies on social engineering to successfully coerce an authenticated user into visiting the crafted URL.",
  "technicalDetails": "The vulnerability is classified as a reflected cross-site scripting flaw occurring in the cmd.cgi component of the affected applications. The root cause stems from insufficient input sanitization and improper output encoding of HTTP request parameters handled by the Common Gateway Interface script. Specifically, the NagFormId parameter fails to adequately neutralize HTML tags and JavaScript constructs before reflecting the input back to the user in the HTTP response.\nThe attack flow begins when an unauthenticated remote attacker crafts a specialized hyperlink targeting the cmd.cgi script. This URL incorporates malicious JavaScript payloads injected directly into the NagFormId parameter. The attacker then distributes this URL to a targeted authenticated user through phishing or other social engineering methods. When the victim clicks the link, their browser sends an HTTP request to the vulnerable Nagios server containing the malicious payload.\nUpon processing the request, the cmd.cgi component reflects the unsanitized contents of the NagFormId parameter back into the generated HTML document. The victim's browser parses the HTTP response and executes the embedded JavaScript payload within the security context of the target web application. Because the victim is authenticated, the executing script inherits their session privileges and permissions, enabling it to interact with the application interface, forge unauthorized requests, or manipulate DOM elements.\nThe affected components comprise Nagios Core versions prior to 4.5.14 and Nagios XI versions prior to 2026R1.7, specifically focusing on the cmd.cgi endpoint. The vulnerability is network-exposed, accessible over standard HTTP or HTTPS protocols, and requires remote network connectivity. While the initial delivery of the payload via the crafted link requires no authentication, the execution phase mandates that the targeted victim holds an active, authenticated session with the Nagios application. Post-exploitation impact is bound by the permissions of the compromised user session, potentially allowing full administrative control over the monitoring infrastructure if an administrator falls victim to the exploit."
}