CVE-2026-48548

Name of the Vulnerable Software and Affected Versions Nagios Core versions prior to 4.5.12

Description A cross-site request forgery (CSRF) issue exists in the 'cmd.cgi' endpoint. The CSRF protection mechanism fails to properly validate requests when the NagFormId cookie is missing. This allows an attacker to send a malicious cross-site POST request that executes arbitrary Nagios commands using the privileges of an authenticated user without their consent. CSRF is a type of attack that tricks a victim into submitting a malicious request.

Recommendations Update Nagios Core to version 4.5.12 or later.