CVE-2026-48551

Name of the Vulnerable Software and Affected Versions Nagios Core versions prior to 4.5.14 Nagios XI versions prior to 2026R1.7

Description Cross-site request forgery (CSRF) protection bypass occurs when an attacker provides a self-supplied double-submit cookie. By supplying matching cookie and request parameter values, unauthenticated attackers can bypass security protections and execute commands as authorized users through malicious links. Double-submit cookies are a stateless CSRF defense mechanism where a random value is sent both in a cookie and a request parameter; the server validates that both values match.

Recommendations Update Nagios Core to version 4.5.14 or later. Update Nagios XI to version 2026R1.7 or later.