Vulnerability Description
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run commands as authorized users via malicious links.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog
- https://www.nagios.com/security-disclosures/nagios-core/
- https://www.vulncheck.com/advisories/nagios-core-xi-csrf-protection-bypass-via-d
FAQ
What is CVE-2026-48551?
CVE-2026-48551 is a vulnerability with a CVSS score of 7.4 (HIGH). Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and requ...
How severe is CVE-2026-48551?
CVE-2026-48551 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-48551?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.