Critical Nagios Flaw CVE-2025-44823 (CVSS 9.9) Leaks Plaintext Admin API Keys, PoC Available

Security researchers have identified two critical Nagios Log Server vulnerabilities, CVE-2025-44823 and CVE-2025-44824, rated 9.9 and 8.5 respectively, that could allow authenticated users to abuse API endpoints and disrupt monitoring. CVE-2025-44823 resides in the /nagioslogserver/index.php/api/system/get_users endpoint, with the advisory stating that authenticated users can retrieve cleartext administrative API keys via that call, effectively exposing all user details including admin keys.

A PoC demonstrates a simple curl request to obtain a JSON array of users and their keys, enabling privilege escalation and impersonation of privileged accounts. The flaws affect Nagios Log Server versions prior to 2024R1.3.2, and the vendor notes that 2024R1.3.2 restricts access to user and key listings and prevents plaintext credentials in API responses.

CVE-2025-44824 affects the /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch endpoint, where an authenticated user with read-only API access can stop Elasticsearch, potentially causing a DoS and disabling real-time log ingestion, even when the error response misleadingly states the stop failed.