Nagios Vulnerability Allows Users to Retrieve Cleartext Administrative API Keys

Security researchers flagged two critical vulnerabilities in Nagios Log Server, tracked as CVE-2025-44823 and CVE-2025-44824, affecting versions prior to 2024R1.3.2. CVE-2025-44823 carries a 9.9 CVSS score and allows any authenticated user to retrieve cleartext administrative API keys via a simple GET request to /nagioslogserver/index.php/api/system/get_users, exposing credentials that could enable full system compromise, classified under CWE-497.

CVE-2025-44824 scores 8.5 and enables authenticated users with read-only API access to stop the Elasticsearch service through /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch, an incorrect authorization issue (CWE-863) that can disrupt logging infrastructure. Organisations should upgrade to version 2024R1.3.2 or later to address both vulnerabilities, and security teams are advised to audit user access levels and monitor for suspicious API calls targeting the vulnerable endpoints.

Given the critical nature of CVE-2025-44823, organisations should rotate all API keys if exploitation occurred, according to the official Nagios changelog.