CVE-2025-44824 Missing authorization in Log Server
Authenticated read-only users can stop the Elasticsearch service, causing denial of service, despite API error messages.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-44824?
CVE-2025-44824 is a high-severity missing authorization vulnerability in Nagios Log Server, published on 7 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "message": "Could not stop elasticsearch" is in the API response. This is GL:NLS#474.
Weakness: CWE-863
Which versions are affected by CVE-2025-44824?
It affects 1 product.
Products include Nagios Log Server.
How do I fix CVE-2025-44824?
No fix has been published for CVE-2025-44824 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-44824 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-44824 exists.
Other vulnerabilities in Nagios Log Server
- CVE-2025-44823 Information disclosure in Log Server
- CVE-2025-34277 Nagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard ID
- CVE-2025-34274 Nagios Log Server < 2024R2.0.3 Logstash Process Root Privileges
- CVE-2023-7322 Nagios Log Server < 2024R1 Incorrect Authorization Granting Full API Access
- CVE-2025-34271 Nagios Log Server < 2024R2.0.2 Cluster Manager Credential Requests Sent Over Plaintext
Sources
Also known as GHSA-mh3w-pwxw-972f.