This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-48549 →

DEBIAN-CVE-2026-48549

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit...

Original description

The description as published by the source.

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allowing a cross-site request to execute Nagios commands as a currently authenticated user.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 nagios4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-4+deb12u2"}]}]

Debian:13 nagios4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-4.1+deb13u2"}]}]

Debian:14 nagios4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.14+ds-1"}]}]

References

advisory security-tracker.debian.org