Nagios XI < 2024R1.4.2 API Key Disclosure via Neptune Themes
Summary
| CVE | CVE-2025-34283 |
|---|---|
| State | PUBLISHED |
| Assigner | VulnCheck |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-10-30 22:15:48 UTC |
| Updated | 2026-10-07 21:10:00 UTC |
| Description | Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value. |
Risk And Classification
Primary CVSS: v4.0 7.1 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.010400000 probability, percentile 0.629130000 (date 2026-10-07)
Problem Types: CWE-497 | CWE-497 CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 7.1 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 7.1 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Primary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Nagios | Nagios Xi | All | All | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.0.1 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.0.2 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.1 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.1.1 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.1.2 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.1.3 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.1.4 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.1.5 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.2 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.2.1 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.2.2 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.3 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.3.1 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.3.2 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.3.3 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.3.4 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.4 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.4.1 | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.vulncheck.com/advisories/nagios-xi-api-key-disclosure-via-neptune-themes | [email protected] | www.vulncheck.com | Third Party Advisory |
| www.nagios.com/changelog/nagios-xi | [email protected] | www.nagios.com | Release Notes |
| www.nagios.com/products/security | [email protected] | www.nagios.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: Nagios addresses this vulnerability as "Nagios XI would sometimes reveal API keys to users that were not authorized for API access" and "Fixed an issue where an API key was shown to users without API access in Neptune themes."