Nagios Vulnerability Allows Users to Retrieve Cleartext Administrative API Keys
Security researchers have identified two vulnerabilities in Nagios Log Server that expose critical system information and allow unauthorized service manipulation.
Security researchers have identified two vulnerabilities in Nagios Log Server that expose critical system information and allow unauthorized service manipulation.
The vulnerabilities, tracked as CVE-2025-44823 and CVE-2025-44824, affect versions prior to 2024R1.3.2 and pose significant risks to enterprise monitoring infrastructure.
CVE ID Affected Product CVSS Score Severity Impact
CVE-2025-44823 Nagios Log Server 9.9 CRITICAL Cleartext API key retrieval
CVE-2025-44824 Nagios Log Server 8.5 HIGH Elasticsearch service disruption
The exposure occurs due to improper handling of sensitive system information.
Critical API Key Exposure Vulnerability
CVE-2025-44823 is a severe security flaw with a CVSS score of 9.9, classified as critical severity. This vulnerability allows authenticated users to retrieve cleartext administrative API keys through a GET request to /nagioslogserver/index.php/api/system/get_users .
The exposure occurs due to improper handling of sensitive system information. The vulnerability requires only valid user authentication to exploit. Once exploited, attackers gain access to administrative API credentials that can be used for complete system compromise. The attack vector is network-based with low complexity, requiring no user interaction.
Service Disruption Through Privilege Escalation
CVE-2025-44824 scores 8.5 on the CVSS scale, enabling authenticated users with read-only API access to stop the Elasticsearch service. Despite receiving a "Could not stop elasticsearch" message in the API response, the service terminates successfully when users call /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch .
This flaw represents an incorrect authorization issue where the system fails to validate user permissions before executing privileged operations. Users with limited read-only access can cause denial of service conditions by disrupting critical logging infrastructure components.
Organizations running affected Nagios Log Server versions should upgrade to version 2024R1.3.2 or later to address both vulnerabilities. Security teams should audit user access levels and monitor for suspicious API calls targeting vulnerable endpoints. Given the critical nature of CVE-2025-44823, it is advisable for organizations to rotate all API keys if exploitation is suspected.
The disclosure of both vulnerabilities underscores the importance of comprehensive security testing in enterprise monitoring solutions, particularly those handling sensitive administrative functions and service control operations.
Based on reporting by GBHackers.