Nagios vulnerabilities
We track 44 vulnerabilities in Nagios products across 7 products. 44 are rated high or critical, and 4 have been exploited in real attacks. The most recent was published on February 20, 2026.
Latest Nagios vulnerabilities
- 8.8 High severity
Host: Improper Neutralization of Special Elements used in an OS Command
Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vu
- 8.8 High severity
Host: Improper Neutralization of Special Elements used in an OS Command
Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerability. The spe
- 8.8 High severity
Host: Improper Neutralization of Special Elements used in an OS Command
Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerabi
- 8.8 High severity
Nagios Xi: Improper Neutralization of Special Elements used in an SQL Command
In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.
- 7.8 High severity
Log Server: Incorrect Permission Assignment for Critical Resource
Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combination of sudo misconfiguration and group-writable application directories. The 'www-data' user is a member of the 'nagios' group, which has write access
- 7.2 High severity
Log Server: Improper Neutralization of Special Elements used in an OS Command
Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental 'Natural Language Queries' feature. When this feature is configured, certain user-controlled settings—including model selection and conn
- 7.2 High severity
XI: Improper Privilege Management
Nagios XI versions prior to 2024R1.1.3 contain a privilege escalation vulnerability in which an authenticated administrator could leverage the Migrate Server feature to obtain root privileges on the underlying XI host. By abusing the migration workflow, an adm
- 8.8 High severity
Log Server: Improper Preservation of Permissions
Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own email to an invalid value and, due to insufficient validation and authorization checks tied to email id
- 7.8 High severity
XI: Incorrect Permission Assignment for Critical Resource
Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodically as the nagios user but owned by www-data. Because the file was writable by www-data, an attacker with web server privileges could modify
- 7.2 High severity
XI: Improper Neutralization of Special Elements used in an OS Command
Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command. Insufficient validation/escaping of parameters used to build backend command lines allows an authenticated administrator to inj
- 8.8 High severity
XI: Improper Neutralization of Special Elements used in an OS Command
Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an authenticated administrator to inject shell metacharacters that are incorporated into backend comman
- 7.2 High severity
Network Analyzer: Improper Neutralization of Special Elements used in an OS Command
Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management functionality whereby the certificate removal operation fails to apply adequate input sanitation. An authenticated administrator can trigger command
- 9.8 Critical severity
Log Server: Improper Control of Generation of Code
Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID values are not properly validated before being forwarded to an internal API. An attacker able to supply crafted dashboard ID values can cause the
- 9.8 Critical severity
Log Server: Execution with Unnecessary Privileges
Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attacker is able to compromise the Logstash process - for example by exploiting an in
- 9.8 Critical severity
Log Server: Cleartext Transmission of Sensitive Information
Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an
- 7.2 High severity
XI: Improper Neutralization of Special Elements used in an OS Command
Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component. Insufficient validation and sanitization of administrator-controlled BPI configuration parameters (notably bpi_logfile an
- 7.8 High severity
Log Server: Incorrect Privilege Assignment
Nagios Log Server versions prior to 2024R1.0.2 contain a local privilege escalation vulnerability that allows an attacker who could execute commands as the Apache web user (or the backend shell user) to escalate to root on the host.
- 7.2 High severity
XI: Improper Privilege Management
Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component. The System Profile feature is an administrative diagnostic/configuration capability. Due to improper access controls and unsafe handling of exp
- 7.2 High severity
XI: Improper Neutralization of Special Elements used in an OS Command
Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard. Insufficient validation of user-supplied input allows an authenticated administrator to inject shell metacharacters that are incorporated
- 8.8 High severity
XI: Improper Neutralization of Special Elements used in an OS Command
Nagios XI versions prior to 2024R1.2 contain a command injection vulnerability in the Docker Wizard. Insufficient validation of user-supplied input in the wizard allows an authenticated administrator to inject shell metacharacters that are incorporated into ba
- 8.8 High severity
XI: Improper Privilege Management
Nagios XI versions prior to 2024R1.2 contain a privilege escalation vulnerability related to NagVis configuration handling (nagvis.conf). An authenticated user could manipulate NagVis configuration data or leverage insufficiently validated configuration settin
- 9.8 Critical severity
XI: Improper Neutralization of Special Elements used in an OS Command
Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP (Nagios Remote Data Processor) server plugins. Insufficient validation of inbound NRDP request parameters allows crafted input to reach command execution paths,
- 9.8 Critical severity
XI: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory (AD) or LDAP authentication token to an authenticated user. Exposure of the server’s AD/LDAP token could allow domain-wide authentication misuse, escala
- 9.8 Critical severity
Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user…
Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed. As a result, any pre-existing sessions (including those potentially controlled by an attacker) remained valid after a credenti
- 8.8 High severity
XI: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Nagios XI versions prior to 2024R1.1.2 may (confirmed in 2024R1.1 and 2024R1.1.1) disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or pass
- 9.8 Critical severity
XI: Missing Authorization
Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control when the 'Allow Insecure Logins' option is enabled. Under this configuration, any user can create valid login credentials for other users without proper authorization. This can lead
- 8.1 High severity
Log Server: Incorrect Authorization
Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless able to invoke API endpoints, resulting in unintended access to data and actions exposed via the API. Th
- 8.8 High severity
XI: Missing Authorization
Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal. A remote, low-privileged attacker could access or interact with the terminal interface without sufficient authorization, potentially allowing unauthoriz
- 8.6 High severity
Fusion: Public cloneable() Method Without Final
Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack.
- 7.6 High severity
Fusion: Improper Authentication
A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack.
- 8.8 High severity
Log Server: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call. This is GL:NLS#475.
- 8.8 High severity
Nagios XI: Improper Neutralization of Special Elements used in an OS Command
Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the s
- 8.8 High severity
Nagios XI: Improper Limitation of a Pathname to a Restricted Directory
Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file paths and extensions during
- 7.5 High severity
An access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to…
An access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improper session invalidation and stale token handling. When an administrator deletes a user account, the backend fails to te
- 8.3 High severity
Log Server: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field.
- 9.1 Critical severity
xi: Improper Neutralization of Input During Web Page Generation
Nagios XI before 2024R1 was discovered to improperly handle API keys generation (randomly-generated), allowing attackers to possibly generate the same set of API keys for all users and utilize them to authenticate.
- 8.4 High severity
plugins: Improper Neutralization of Special Elements used in a Command
check_by_ssh in Nagios nagios-plugins 2.4.5 allows arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with \${IFS}. This has been categorized both as fixed in e8810de, and as intended behavior.
- 9.8 Critical severity
nagios_xi: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php component.
- 7.2 High severity
Nagios Xi: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings.
- 8.8 High severity
Nagios Xi: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the update_banner_message() function.