CVE-2026-48548

NameCVE-2026-48548
DescriptionNagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently authenticated user without their knowledge or consent.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6308-1
Debian Bugs1136340

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nagios4 (PTS)bookworm4.4.6-4+deb12u1fixed
bookworm (security)4.4.6-4+deb12u2fixed
trixie4.4.6-4.1+deb13u1fixed
trixie (security)4.4.6-4.1+deb13u2fixed
sid4.5.14+ds-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nagios4sourcebookworm4.4.6-4+deb12u1
nagios4sourcetrixie4.4.6-4.1+deb13u1
nagios4source(unstable)4.5.12+ds-11136340

Notes

Fixed by: https://github.com/NagiosEnterprises/nagioscore/commit/e5ed38e53a5d65721520c7c67be0746d63da28cb (nagios-4.5.12)
Search for package or bug name: Reporting problems