Description
Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "message": "Could not stop elasticsearch" is in the API response. This is GL:NLS#474.
Affected products
nagios: log server
References3
- github.com/skraft9/nagios-log-server-dos ExploitThird Party Advisory
- github.com/skraft9/nagios-log-server-dos ExploitThird Party Advisory
- www.nagios.com/changelog/#log-server Release Notes
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - EPSS — exploit probability
- 3% percentile: 86 · as of 9 November 2026
- CWE
- CWE-863
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.