CVE-2026-48552

Executive Summary

CVE-2026-48552 is a DOM-based cross-site scripting (XSS) vulnerability affecting Nagios Core before 4.5.14 and Nagios XI before 2026R1.7, residing in the jsonquery.js component. An authenticated attacker can store malicious JSON string values that are later reflected unencoded into the victim's browser DOM, enabling arbitrary JavaScript execution when an administrator or other user views the affected page. With a CVSS 3.1 base score of 5.4 (Medium), the vulnerability requires low-privilege authenticated access and user interaction, but its scope-changed nature allows the attacker to pivot from the vulnerable application context into the victim's session.

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically manifesting as DOM-based cross-site scripting. The NVD description identifies the flaw in the JavaScript file jsonquery.js, which is part of both Nagios Core and Nagios XI web front-ends.

DOM-based XSS differs from reflected and stored XSS in that the payload never transits the server-side response-scripting layer; instead, client-side JavaScript reads attacker-influenced data from a DOM source and passes it to a dangerous sink (e.g., DOM insertion, innerHTML assignment, document.write, or similar mechanisms). In this case, the NVD description states that "unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization." This means:

1. The attacker supplies a JSON string value containing attacker-controlled JavaScript (e.g., <img src=x onerror=...> or javascript:-style vectors) that is persisted in a "stored field" within the Nagios application — for example, a device name, service description, host alias, contact field, or similar data object managed by the application.
2. When a victim browser loads a page that uses jsonquery.js, the script retrieves these stored values — likely via an AJAX/JSON request — and inserts the unencoded string values into the document DOM.
3. Because the values are inserted without sanitization, the browser interprets embedded HTML/JavaScript, executing the payload in the context of the Nagios origin.

Key technical characteristics from the supplied data:

• Attack vector: Network (AV:N) — the vulnerable feature is reachable over HTTP/HTTPS.
• Attack complexity: Low (AC:L) — no race conditions, special network position, or probabilistic conditions required.
• Privileges required: Low (PR:L) — the attacker must have an authenticated account able to write to the stored fields that are later rendered via jsonquery.js.
• User interaction: Required (UI:R) — a victim (typically an administrator or another user with a more privileged session) must open the affected page.
• Scope: Changed (S:C) — execution occurs in the victim's browser context but can affect resources beyond the vulnerable component (e.g., the victim's authenticated session to Nagios).
• Impact: Low confidentiality and low integrity (C:L/I:L); no direct availability impact (A:N).

The EPSS score of 0.00165 (6.2nd percentile) indicates a low predicted probability of exploitation in the wild as of the assessment date. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, no public PoC, Nuclei template, or exploit code has been observed, and no vendor-supplied workarounds or technical patch details beyond the version bump are available at the time of writing. The patch confidence of 2/4 reflects that only a single source (OSV) claims the fix exists; this has not been independently confirmed via a vendor advisory or release notes.

Insufficient technical detail is available in the public description to name the exact stored-field locations, the precise DOM sink function, or the HTTP endpoints involved; the attack mechanism must therefore be understood at the vulnerability-class level (DOM-based XSS with stored data flow).

Exploitation Scenarios

No public PoC or exploit code is currently available; the attack chain below is inferred from the vulnerability class (stored DOM-based XSS) and the NVD description. Only the explicitly named component (jsonquery.js) and affected product lines (Nagios Core, Nagios XI) are referenced.

1. Reconnaissance / target identification. An attacker with low-privilege authenticated access to a Nagios Core (pre-4.5.14) or Nagios XI (pre-2026R1.7) instance identifies input fields whose values are stored and later rendered through jsonquery.js. These are typically configuration objects such as host/service names, contact details, or other monitoring metadata visible in the web UI. The attacker fingerprints the installed version to confirm the vulnerable build.

2. Triggering the flaw class. As an authenticated low-privilege user, the attacker submits a crafted value containing an HTML/JavaScript payload — e.g., <script> content or an event-handler attribute — into one of the stored fields. Because the application does not encode or sanitize the value when it is later serialized into JSON and served to the browser, the payload is preserved verbatim in the stored record.

3. Payload execution. A victim (for example, a Nagios administrator with broader privileges) navigates to a monitoring page that invokes jsonquery.js. The script fetches the stored JSON data and inserts the unencoded string values into the DOM. The browser parses the attacker-controlled markup as active content and executes the JavaScript in the context of the Nagios origin, bypassing the same-origin boundary between the injected code and the application's legitimate scripts. Execution can occur without any further action from the victim beyond loading the page (UI:R is satisfied by the page view itself).

4. Post-exploitation impact. The executed JavaScript inherits the victim's session origin. Impact is constrained to low confidentiality and low integrity per the CVSS vector, but within the browser session this can translate into: exfiltration of the victim's CSRF tokens/session cookies to an attacker-controlled endpoint; modification of Nagios configuration or acknowledgment/notification state via authenticated API calls performed in the victim's session; defacement of the monitoring console; or lateral movement within the browser context to other same-origin resources. Because the attacker already holds low-privilege credentials, the marginal gain is typically privilege escalation to the victim's role or tampering with monitoring data that may blind operators to infrastructure incidents.

No evidence of in-the-wild exploitation, known threat actor campaigns, or ransomware use has been identified for this CVE at the time of writing.

Impact Assessment

• Affected systems: Nagios Core deployments prior to version 4.5.14 and Nagios XI deployments prior to version 2026R1.7. Nagios is widely deployed for infrastructure monitoring in enterprise environments, often with network-visible web consoles and administrative dashboards, which increases the practical exposure of the vulnerable component.
• Business impact: A successful attack undermines the confidentiality (C:L) and integrity (I:L) of the monitoring platform. For an operations tool, integrity compromise is especially damaging: an attacker who can alter displayed host/service states or inject misleading alerts can degrade the organization's ability to detect real outages. Session hijacking of an administrator account further enables configuration tampering, credential harvesting, and potential pivoting into monitored infrastructure via stored credentials or scripts commonly present in monitoring platforms.
• Blast radius: The CVSS scope is "Changed" (S:C), meaning the compromised component is the browser-side rendering layer while the impact extends to the broader Nagios application and any same-origin resources. The requirement for low-privilege authentication (PR:L) limits external attackers but makes this a significant post-compromise escalation vector for anyone who already holds a weak or stolen monitoring account (e.g., a read-only "guest" account). The absence of public exploit code and the low EPSS score currently mitigate immediate mass exploitation risk, but the vulnerability is likely reachable by any authenticated user in a typical Nagios environment, making the real-world attack surface larger than the "Low privilege" score suggests.
• Availability: No direct availability impact (A:N) is included in the score; however, denial-of-service via browser resource exhaustion is a plausible secondary effect if an attacker supplies extremely large payloads in stored fields.

Detection Guidance

The following detection rules target the observable artifacts of this vulnerability class: (a) write-time storage of script-bearing values into Nagios data, (b) serve-time delivery of unencoded payloads in JSON/DOM responses referencing jsonquery.js, and (c) anomalous browser-side execution behavior. Because this is a DOM-based XSS, server-side web logs alone are insufficient — response-body inspection (IDS/proxy) and endpoint telemetry significantly improve coverage. Where the rules reference Nagios URI context, jsonquery is the only file name available from the advisory and should be treated as a detection anchor rather than an exhaustive pattern.

Sigma Rule

title: Nagios jsonquery.js Response with Unencoded Script Payload
id: 04a6c1d2-4f58-4c74-9e0a-2a5b9f3d8c17
status: experimental
description: Detects HTTP responses from Nagios hosts that reference jsonquery.js and contain unencoded script content, indicative of stored DOM-based XSS (CVE-2026-48552).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-48552
author: Threat Intelligence Team, valtersit.com
date: 2026/08/01
logsource:
    category: webserver
    product: proxy
    definition: 'Requires response-body inspection via reverse proxy, load balancer, or network IDS logging.'
detection:
    selection_uri:
        cs-uri-path|contains: 'jsonquery'
    selection_body_script:
        http_response_body|contains|all:
            - '<script'
            - 'jsonquery'
    selection_body_embedded:
        http_response_body|contains|any:
            - 'onerror='
            - 'javascript:'
            - '<img'
    condition: selection_uri and (selection_body_script or selection_body_embedded)
level: medium
falsepositives:
    - Legitimate monitoring data containing HTML/script snippets (e.g., a host check result echoing a script tag).
    - Benign use of jsonquery.js rendering escaped data in properly configured installations.

YARA Rule

rule CVE_2026_48552_Nagios_DOM_XSS
{
    meta:
        author = "Threat Intelligence Team, valtersit.com"
        description = "Detects traffic or captured web content carrying jsonquery.js alongside unencoded script-bearing JSON values associated with Nagios stored DOM XSS (CVE-2026-48552)."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-48552"
        cve = "CVE-2026-48552"
        severity = "medium"
        date = "2026-08-01"
    strings:
        $jsonquery = "jsonquery.js" ascii wide nocase
        $script_open = "<script" ascii wide nocase
        $event_handler = "onerror=" ascii wide nocase
        $event_handler2 = "onload=" ascii wide nocase
        $js_scheme = "javascript:" ascii wide nocase
        $json_brace = "\"}" ascii wide
        $img_tag = "<img" ascii wide nocase
    condition:
        $jsonquery and 1 of ($script_open, $event_handler, $event_handler2, $js_scheme, $img_tag)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-48552 Nagios jsonquery.js Stored DOM XSS Payload in Response"; flow:established,to_client; file.data; content:"jsonquery.js"; nocase; content:"<script"; nocase; within:4096; sid:202648552; rev:1; metadata:created_at 2026_08_01, updated_at 2026_08_01, cve CVE-2026-48552, tag xss, tag nagios, tag stored-dom-xss; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-48552; classtype:web-application-attack; priority:2;)

Elastic Detection

// EQL for proxy / HTTP-layer telemetry (Elastic Common Schema)
// Fires when a Nagios response body delivering jsonquery.js contains script-bearing content.
any where network.protocol == "http"
    and http.response.status_code == 200
    and (url.path like "*jsonquery*" or url.full like "*jsonquery*")
    and (
        http.response.body like "*<script*"
        or http.response.body like "*onerror=*"
        or http.response.body like "*javascript:*"
    )

// Alternative: endpoint-side detection of suspicious script execution in browser processes
// loading Nagios pages (requires browser/EDR telemetry mapping process.command_line to URL strings).
process where event.action in ("start", "exec") and process.name in ("chrome", "firefox", "msedge", "iexplore")
    and process.command_line like "*nagios*" and process.command_line like "*javascript:*"

Splunk SPL Query

index=proxy OR index=web
  (uri_path LIKE "%jsonquery%" OR url LIKE "%jsonquery%" OR http_content_type="application/json")
  AND (http_response_body LIKE "%<script%" OR http_response_body LIKE "%onerror=%" OR http_response_body LIKE "%javascript:%")
  AND (url LIKE "%nagios%" OR uri_path LIKE "%nagios%" OR src_category="monitoring")
| stats count by src_ip, dest_ip, url, http_response_body
| where count > 1

# Complementary write-time detection: authenticated POSTs carrying script indicators to Nagios storage endpoints
index=web
  method=POST
  AND (form_data LIKE "%<script%" OR body LIKE "%onerror=%" OR body LIKE "%javascript:%")
  AND (uri_path LIKE "%nagios%" OR referer LIKE "%nagios%")
| table _time, src_ip, user, uri_path, body

Wazuh OSSEC Rule

<group name="web,nagios,cve-2026-48552,">
  <!-- Local decoder: raw log lines produced by reverse proxy / web access log for Nagios -->
  <decoder name="nagios_http_proxy">
    <prematch>\d+\.\d+\.\d+\.\d+ .*"(GET|POST) .*nagios</prematch>
    <regex>(\d+\.\d+\.\d+\.\d+) \S+ \S+ \[[^\]]+\] "(GET|POST) (\S+) [^"]+" (\d+)</regex>
    <order>srcip, action, url, id</order>
  </decoder>

  <rule id="100486" level="12">
    <if_sid>100000</if_sid>
    <decoded_as>nagios_http_proxy</decoded_as>
    <field name="url">\.jsonquery|jsonquery</field>
    <description>Nagios CVE-2026-48552: Request referencing jsonquery.js observed.</description>
    <group>nagios_xss,</group>
  </rule>

  <rule id="100487" level="14">
    <if_sid>100486</if_sid>
    <match>%3Cscript|<script|onerror=|javascript:</match>
    <description>Nagios CVE-2026-48552: Script payload indicators in conjunction with jsonquery.js - possible stored DOM XSS attempt or exploitation artifact.</description>
    <group>nagios_xss,attack,</group>
  </rule>
</group>

Detection caveats: Since the payload is stored server-side and executed client-side, the most reliable detection point is response-body inspection at a reverse proxy or IDS (covered by Sigma/Suricata/YARA) combined with endpoint browser telemetry (Elastic). Web application firewalls should additionally enforce output encoding for JSON endpoints returning stored fields, and alert on any <script> content in JSON responses from Nagios hosts, while excluding known-legitimate check results.

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED). The fix is currently supported only by a single source (OSV) asserting that Nagios Core 4.5.14 and Nagios XI 2026R1.7 resolve the issue. Before relying on the patch in production, verify the version fix against an official Nagios advisory, release notes, or changelog — independent confirmation is still outstanding. No vendor-supplied workarounds or CVEs cross-references are available at this time.

1. Immediate mitigations (until the patch is verified and applied):

   • Limit access to the Nagios web console to trusted networks and enforce multi-factor authentication for all accounts, particularly administrative roles, to reduce the likelihood that a low-privilege account can be abused to store payloads.
   • Apply a virtual-patch/WAF rule that inspects responses from Nagios hosts and blocks/blocks rendering of responses containing <script>, onerror=, javascript:, or <img sequences in JSON bodies associated with jsonquery.js.
   • Audit existing stored configuration data for script-bearing values in host/service/contact fields; if any are found, assume compromise of every account that viewed the affected pages and rotate credentials/API keys.
   • Restrict the jsonquery.js-driven pages to administrators only, where operational requirements permit, and avoid browsing the monitoring console during elevated (e.g., domain-admin) sessions.

2. Patch/upgrade steps:

   • Upgrade Nagios Core to version 4.5.14 or later and Nagios XI to version 2026R1.7 or later as soon as the fix is independently confirmed.
   • Before upgrading, back up the Nagios configuration and monitoring database; after upgrading, verify JSON rendering behavior (e.g., confirm that stored HTML tag values are displayed as literal text, not executed).
   • Re-run the detection rules from this report after patching to confirm no residual payloads or exploitation artifacts remain.

3. Long-term hardening:

   • Enforce output encoding/sanitization for all JSON-serialized values rendered into the DOM, and add Content Security Policy (CSP) headers with script-src 'self' and object-src 'none' on Nagios web responses to provide a defense-in-depth boundary against any future XSS.
   • Use the X-Content-Type-Options: nosniff header and strict X-Frame-Options/frame-ancestors settings to reduce browser-side attack surface.
   • Place the Nagios console behind a reverse proxy with response-body inspection and TLS termination, and restrict login to VPN-only or SSO-protected access.
   • Monitor OSV and NVD feeds for updates on CVE-2026-48552 — the patch confidence may change if the vendor formally confirms the fix or additional exploit details emerge.
   • Regularly review accounts with low-privilege access to Nagios; the PR:L requirement means any dormant or shared account can be the initial foothold for this XSS chain.

References

1. NVD Entry — CVE-2026-48552: https://nvd.nist.gov/vuln/detail/CVE-2026-48552
2. OSV Advisory (patch source, single-source claim): https://osv.dev/vulnerability/CVE-2026-48552
3. Nagios Official Site (for vendor release notes and changelogs): https://www.nagios.org
4. MITRE ATT&CK — T1059.007 Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/
5. CISA Known Exploited Vulnerabilities Catalog (confirmed not listed for this CVE): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild status: No known threat actor campaigns, exploit-in-the-wild reports, or CISA KEV listing exist for CVE-2026-48552 as of the report date. EPSS estimates a 0.00165 probability of exploitation (6.2nd percentile of all CVEs), reflecting low current real-world interest; however, the stored-XSS mechanism in a widely deployed network-monitoring product warrants proactive patching rather than risk acceptance.