Introduction
In a vulnerable Nagios Log Server deployment, an attacker with even minimal access can escalate to full administrative control. One API call gives any authenticated account the cleartext API keys of every user, administrators included. Nagios Log Server is a widely used enterprise log management product from Nagios Enterprises, a major IT infrastructure monitoring vendor with a global customer base and a product suite that includes Nagios XI, Core, and Network Analyzer. Organizations often deploy it in critical environments to centralize and analyze log data, so a compromise there does particular damage.
Technical Information
CVE-2025-44823 affects Nagios Log Server versions before 2024R1.3.2. The vulnerability is in the /nagioslogserver/index.php/api/system/get_users API endpoint. Any authenticated user, whatever their privilege level, can send a GET request to this endpoint with a valid API token. The endpoint returns a JSON object with sensitive details for every user: usernames, email addresses, and, worst of all, their API keys in cleartext.
The root cause is a missing authorization check. The endpoint does not restrict access to administrative users and hands this data to any authenticated session. That breaks the principle of least privilege and opens the whole system to privilege escalation. Exploit-DB entry 52177 documents the exploitation method in detail. An attacker can use a command like:
curl -X GET "http://<target-ip>/nagioslogserver/index.php/api/system/get_users?token=<valid_token>"
The response lists every user account with its API key, so an attacker can escalate privileges immediately and potentially compromise the entire system. The vulnerability is classified under CWE-497 (exposure of sensitive system information to an unauthorized control sphere).
Affected Systems and Versions
- Product: Nagios Log Server
- Affected versions: All versions before 2024R1.3.2 (including 2024R1.3.1 and earlier)
- Vulnerable configuration: Any deployment where users can authenticate and access the API
Vendor Security History
Nagios Enterprises ships security updates regularly across its product line. In 2025, Nagios Log Server had several critical vulnerabilities, including CVE-2025-29471 (stored XSS) and this API key disclosure. Nagios released patches promptly, but the repeated high-severity issues in the same product family suggest architectural weaknesses in access control and in the company's internal security review.
