CVE-2026-48551

CVE-2026-48551 is a trivially exploitable CSRF bypass in Nagios Core and XI. The double-submit cookie protection accepts self-supplied values—meaning the server compares a cookie value the client controls against a parameter the client also controls. An attacker satisfies the check by submitting identical values in both locations. This isn't a subtle cryptographic failure; it's a wholesale inversion of the double-submit pattern, where the server should generate and set the token, never accept one from the client. Affected versions are Nagios Core through 2026R1.7 and Nagios XI through 4.5.14. The CVSS of 7.4 reflects technical severity, but the exploitation barrier is low—authenticated users can be tricked into executing actions via crafted links. The EPSS score suggests low automated exploitation, which likely reflects the specific population (infrastructure monitoring tools behind authentication) rather than the actual impact. The critical concern here is blast radius. Most CSRF vulnerabilities let attackers change a user's email or post as them—bad but contained. Nagios runs commands on monitored infrastructure, often with elevated privileges. A successful CSRF attack can translate into arbitrary command execution on everything under Nagios's management. This inverts the typical CSRF risk calculus: for monitoring tools, the 'if exploited' outcome is infrastructure compromise, not user embarrassment. From a defensive standpoint: prioritize this patch regardless of the EPSS signal. The low exploitation probability reflects narrow attacker opportunity, not narrow impact. If your Nagios instance has network access to critical systems, treat this as a critical vulnerability. Verify the patch includes server-side token generation enforcement—anything that continues accepting client-supplied cookie values leaves the bypass intact.

Reviewed through automated stages and approved by a human before publication.