High severity7.4NVD Advisory· Published Aug 12, 2026

CVE-2026-48551

Description

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run commands as authorized users via malicious links.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nagios/nagioscorellm-create
Range: <4.5.14
Nagios/Nagios XIllm-create
Range: <2026R1.7

Patches

Vulnerability mechanics

References

github.com/NagiosEnterprises/nagioscore/blob/master/Changelognvd
www.nagios.com/security-disclosures/nagios-core/nvd
www.vulncheck.com/advisories/nagios-core-xi-csrf-protection-bypass-via-double-submit-cookienvd

News mentions

No linked articles in our index yet.

cvss	0.481
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000