Description
Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allowing a cross-site request to execute Nagios commands as a currently authenticated user.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Nagios Enterprises, LLC. Nagios Core
Default version status: affected
0 to < 4.5.13affected
Nagios Enterprises, LLC. Nagios XI
Default version status: affected
0 to < 2026R1.5affected