Description

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor (NRDP). When a custom variable defined on a host, service, or contact is referenced in a shell-executed command line, an authenticated attacker with NRDP access can inject OS commands through the macro value. Exploitation requires a non-default configuration in which a custom variable is defined and referenced in a shell-executed command.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-12T17:17:27.697Z",
  "pubdate": "2026-08-12T17:17:27.697Z",
  "executiveSummary": "Nagios Core before version 4.5.13 and Nagios XI before version 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection.\nThe vulnerability resides within the Nagios Remote Data Processor (NRDP) component.\nAn authenticated attacker with access to NRDP can inject arbitrary operating system commands by leveraging custom variables defined on hosts, services, or contacts that are subsequently referenced within shell-executed command lines.\nSuccessful exploitation allows attackers to achieve remote code execution on the underlying host operating system with the privileges of the Nagios application process.\nThis vulnerability presents a high risk to confidentiality, integrity, and availability.\nExploitation requires authentication and a non-default configuration where a custom variable is explicitly defined and referenced in a shell-executed command.",
  "technicalDetails": "The vulnerability is caused by improper neutralization of special elements used in an OS command, specifically via custom-variable macro injection through the Nagios Remote Data Processor (NRDP).\nAffected products include Nagios Core prior to version 4.5.13 and Nagios XI prior to version 2026R1.5.\nThe vulnerable component is the NRDP interface and the macro substitution engine responsible for processing custom variables defined on hosts, services, or contacts.\nPrerequisites for exploitation mandate that an attacker possesses valid authentication credentials granting access to NRDP, and that a non-default configuration exists wherein a custom variable is defined and subsequently referenced within a shell-executed command line.\nThe attack flow proceeds as follows: First, the attacker identifies or induces a non-default configuration where user-controlled or modifiable custom variables are evaluated inside shell-executed commands. Second, the attacker submits maliciously crafted input containing OS command injection payloads via the NRDP mechanism. Third, the Nagios processing engine resolves the custom-variable macro, substituting the injected payload directly into the command string without adequate sanitization or escaping. Finally, the operating system executes the resulting shell command, leading to unauthorized code execution within the security context of the Nagios daemon."
}