This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-48548 →

DEBIAN-CVE-2026-48548

Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when th...

Original description

The description as published by the source.

Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently authenticated user without their knowledge or consent.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 nagios4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-4+deb12u1"}]}]

Debian:13 nagios4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-4.1+deb13u1"}]}]

Debian:14 nagios4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.12+ds-1"}]}]

References

advisory security-tracker.debian.org