CVE-2026-48551CWE-352csrf

CVE-2026-48551

High · published August 12, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
17.3
In the wild
Unconfirmed
What it is

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run commands as authorized users via malicious links.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00264 · 17.3th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-08-12T21:17Z
References (3)
https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog · [email protected]https://www.nagios.com/security-disclosures/nagios-core/ · [email protected]https://www.vulncheck.com/advisories/nagios-core-xi-csrf-protection-bypass-via-double-submit-cookie · [email protected]
EPSS history
Timeline
  • 12 AUG 16:32Z
    Nagios Core / XI CSRF Protection Bypass via Double-Submit Cookie
    cvelistv5