Nagios Core
Monthly
Cross-site request forgery in Nagios Core (before 4.5.13) and Nagios XI (before 2026R1.5) allows an attacker to execute arbitrary Nagios commands on behalf of an authenticated user by exploiting a bypass in the double-submit cookie CSRF protection implemented in cmd.cgi. When the Cookie header is absent in a POST request, the server's CSRF check can be satisfied simply by supplying matching NagFormId and nagFormId values in the POST body - a condition entirely within the attacker's control. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the technique is well-understood and the bypass mechanism is straightforward to reproduce.
Cross-site request forgery in Nagios Core before 4.5.12 enables remote attackers to execute arbitrary monitoring commands by tricking an authenticated administrator into visiting a malicious page. The flaw in cmd.cgi stems from a logic inversion: the CSRF protection mechanism treats an absent NagFormId cookie as a passing check rather than a failing one, rendering the protection entirely ineffective. The CVSS 4.0 vector (VI:H, UI:A) confirms real integrity risk - an attacker can issue commands under a victim session - though user interaction is required and no public exploit or CISA KEV listing exists at time of analysis.
Remote code execution in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows authenticated UI users to run arbitrary OS commands as the nagios system user by injecting shell metacharacters through the com_data parameter when notification commands reference $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ macros in shell-executed positions. The vulnerability is classified as CWE-78 (OS Command Injection) and reported by VulnCheck; vendor-released patches are now available for both product lines. No public exploit identified at time of analysis, and exploitation is bounded by a non-default notification command configuration requirement reflected in the CVSS 4.0 AT:P metric.
Authenticated remote code execution in Nagios Core (before 4.5.13) and Nagios XI (before 2026R1.5) is achievable via OS command injection through custom-variable macros processed by the Nagios Remote Data Processor (NRDP). An attacker with valid NRDP access can embed shell metacharacters in a custom variable value that is later expanded inside a shell-executed command definition, causing arbitrary OS commands to run with the privileges of the Nagios process. No public exploit code or CISA KEV listing exists at time of analysis, but impact is rated high across confidentiality, integrity, and availability given full command execution on the monitoring server.
DOM-based cross-site scripting in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows an authenticated low-privileged attacker to execute arbitrary JavaScript in the browser of any user who views pages rendered by the vulnerable jsonquery.js component. The flaw is stored rather than reflected, meaning injected payloads persist server-side and activate without requiring a victim to follow a crafted link. No CISA KEV listing and no public exploit code have been identified at time of analysis; the vendor has released patches for both product lines.
Cross-site request forgery protection bypass in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows unauthenticated remote attackers to execute monitoring commands with the privileges of authenticated users by exploiting a flawed double-submit cookie implementation. The CSRF defense can be entirely circumvented by supplying self-crafted, matching cookie and request parameter values - no server-validated token is required - enabling command execution via maliciously crafted links sent to authenticated administrators. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the low attack complexity and broad target population make this a meaningful risk for any externally reachable Nagios deployment.
Reflected cross-site scripting in Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser of an authenticated victim. The injection point is the NagFormId parameter in cmd.cgi, which is insufficiently sanitized before being reflected in server responses. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and zero-privilege requirement for the attacker make phishing-style delivery straightforward against administrators of these monitoring platforms.
Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding - deleting for hosts or servers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified check_load plugin to NRPE. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
qh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this file is owned by a non-root account (and similarly can have nagios.cfg owned by. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Cross-site request forgery in Nagios Core (before 4.5.13) and Nagios XI (before 2026R1.5) allows an attacker to execute arbitrary Nagios commands on behalf of an authenticated user by exploiting a bypass in the double-submit cookie CSRF protection implemented in cmd.cgi. When the Cookie header is absent in a POST request, the server's CSRF check can be satisfied simply by supplying matching NagFormId and nagFormId values in the POST body - a condition entirely within the attacker's control. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the technique is well-understood and the bypass mechanism is straightforward to reproduce.
Cross-site request forgery in Nagios Core before 4.5.12 enables remote attackers to execute arbitrary monitoring commands by tricking an authenticated administrator into visiting a malicious page. The flaw in cmd.cgi stems from a logic inversion: the CSRF protection mechanism treats an absent NagFormId cookie as a passing check rather than a failing one, rendering the protection entirely ineffective. The CVSS 4.0 vector (VI:H, UI:A) confirms real integrity risk - an attacker can issue commands under a victim session - though user interaction is required and no public exploit or CISA KEV listing exists at time of analysis.
Remote code execution in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows authenticated UI users to run arbitrary OS commands as the nagios system user by injecting shell metacharacters through the com_data parameter when notification commands reference $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ macros in shell-executed positions. The vulnerability is classified as CWE-78 (OS Command Injection) and reported by VulnCheck; vendor-released patches are now available for both product lines. No public exploit identified at time of analysis, and exploitation is bounded by a non-default notification command configuration requirement reflected in the CVSS 4.0 AT:P metric.
Authenticated remote code execution in Nagios Core (before 4.5.13) and Nagios XI (before 2026R1.5) is achievable via OS command injection through custom-variable macros processed by the Nagios Remote Data Processor (NRDP). An attacker with valid NRDP access can embed shell metacharacters in a custom variable value that is later expanded inside a shell-executed command definition, causing arbitrary OS commands to run with the privileges of the Nagios process. No public exploit code or CISA KEV listing exists at time of analysis, but impact is rated high across confidentiality, integrity, and availability given full command execution on the monitoring server.
DOM-based cross-site scripting in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows an authenticated low-privileged attacker to execute arbitrary JavaScript in the browser of any user who views pages rendered by the vulnerable jsonquery.js component. The flaw is stored rather than reflected, meaning injected payloads persist server-side and activate without requiring a victim to follow a crafted link. No CISA KEV listing and no public exploit code have been identified at time of analysis; the vendor has released patches for both product lines.
Cross-site request forgery protection bypass in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows unauthenticated remote attackers to execute monitoring commands with the privileges of authenticated users by exploiting a flawed double-submit cookie implementation. The CSRF defense can be entirely circumvented by supplying self-crafted, matching cookie and request parameter values - no server-validated token is required - enabling command execution via maliciously crafted links sent to authenticated administrators. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the low attack complexity and broad target population make this a meaningful risk for any externally reachable Nagios deployment.
Reflected cross-site scripting in Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser of an authenticated victim. The injection point is the NagFormId parameter in cmd.cgi, which is insufficiently sanitized before being reflected in server responses. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and zero-privilege requirement for the attacker make phishing-style delivery straightforward against administrators of these monitoring platforms.
Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding - deleting for hosts or servers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified check_load plugin to NRPE. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
qh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this file is owned by a non-root account (and similarly can have nagios.cfg owned by. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.