Description

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a shell-reachable position, authenticated UI users can run arbitrary commands as the nagios user. Exploitation requires a non-default configuration in which a notification command references these macros in a shell-executed command line.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-12T17:17:27.840Z",
  "pubdate": "2026-08-12T17:17:27.840Z",
  "executiveSummary": "Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are susceptible to an authenticated remote code execution vulnerability.\nThe vulnerability is driven by unfiltered NOTIFICATION-family macro substitution through the com_data parameter.\nThe impact of this flaw allows authenticated users to execute arbitrary system commands with the privileges of the underlying nagios user account.\nAffected systems include Nagios Core and Nagios XI across specified vulnerable versions.\nThe risk implications are severe, as successful exploitation results in full code execution within the context of the monitoring application user, potentially facilitating lateral movement or system compromise.\nAttacker capabilities require authenticated access to the Nagios user interface.\nExploitation requirements dictate a non-default configuration scenario where a notification command explicitly references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ macros within a shell-reachable position, such as a shell-executed command line.",
  "technicalDetails": "The vulnerability resides in the macro substitution engine of Nagios Core and Nagios XI, specifically handling NOTIFICATION-family macros passed via the com_data parameter.\nThe root cause stems from insufficient input filtering and lack of proper sanitization or escaping when substitute macro values are interpolated into notification commands.\nThe affected components are the notification handling subsystems and user interface parameters that process macro substitution.\nAffected versions comprise Nagios Core prior to 4.5.14 and Nagios XI prior to 2026R1.7.\nAuthentication requirements mandate that the attacker possesses valid credentials to access the Nagios UI.\nPrivilege requirements are limited to authenticated UI users, though execution occurs under the security context of the nagios system user.\nNetwork exposure involves accessibility to the web-based management interface of the Nagios server.\nThe attack flow proceeds as follows: First, an authenticated attacker interacts with the web interface and injects malicious payload strings into the com_data parameter. Second, the application triggers a notification event that invokes a notification command configured in a non-default setup. Third, the command line evaluates shell-reachable positions that incorporate macro variables such as $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$. Fourth, because the injected input containing shell metacharacters or commands is unsanitized, the underlying shell interprets and executes the arbitrary attacker-supplied commands.\nThe payload behavior involves the execution of arbitrary system commands directly via the shell invocation utilized by the notification command.\nPost-exploitation impact includes complete compromise of the execution context, enabling attackers to read sensitive configuration files, pivot to internal networks, or execute further system-level binaries with nagios privileges."
}