Description

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run commands as authorized users via malicious links.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-12T17:17:27.353Z",
  "pubdate": "2026-08-12T17:17:27.353Z",
  "executiveSummary": "A cross-site request forgery protection bypass vulnerability exists within Nagios Core before 4.5.14 and Nagios XI before 2026R1.7. This security flaw stems from an improper implementation of the double-submit cookie validation mechanism, allowing unauthenticated threat actors to bypass built-in cross-site request forgery defenses entirely. By supplying matching values within both the HTTP cookie and the corresponding request parameters, an external attacker can successfully forge malicious HTTP requests that are processed as legitimate actions. The primary business impact of this vulnerability involves the potential for remote command execution under the security context of an authenticated victim user. Successful exploitation enables malicious actors to leverage victim sessions simply by tricking authorized users into interacting with maliciously crafted hyperlinks or external resources. Consequently, this exposes affected monitoring infrastructures to unauthorized administrative actions, privilege abuse, and potential system compromise. Remediation requires updating the affected software to the patched versions designated by the vendor.",
  "technicalDetails": "The vulnerability is rooted in a fundamental design flaw within the anti-cross-site request forgery protection mechanism utilized by Nagios Core before 4.5.14 and Nagios XI before 2026R1.7. Specifically, the application validates state-changing operations by comparing a token transmitted via a request parameter against a token stored within a browser cookie, a pattern commonly known as the double-submit cookie technique. However, the application fails to properly enforce that the cookie is cryptographically bound to the authenticated user session or validated against a securely generated server-side state. Instead, the logic accepts validation when the self-supplied double-submit cookie and the corresponding request parameter values match each other. This architectural weakness allows an unauthenticated attacker to arbitrarily generate and supply matching values for both the cookie and the request parameters. The attack flow initiates when an attacker crafts a malicious link or embeds an automated cross-site request forgery payload on an external or accessible web page. When an authorized user interacts with this malicious resource while maintaining an active session within Nagios Core or Nagios XI, the browser automatically dispatches requests to the vulnerable application containing the attacker-controlled parameter and cookie values. Because the application validation routine incorrectly confirms parity between the supplied token values without verifying origin integrity or session ownership, the cross-site request forgery protection mechanism is successfully bypassed. The underlying vulnerable component is the session validation and request verification module responsible for handling incoming HTTP POST or state-changing requests. Upon bypassing the protection mechanism, the application processes the request within the privilege context of the victim user. This enables unauthenticated remote attackers to execute arbitrary commands, modify system configurations, or trigger unauthorized actions as authorized users. The vulnerability requires network exposure of the Nagios web interface and relies on user interaction, such as convincing an authenticated administrator or operator to click a malicious link."
}