CVE-2024-13999 is a critical (CVSS 9.8) information disclosure flaw in Nagios XI versions before 2024R1.1.3. Under certain circumstances the server's Active Directory or LDAP authentication token is shown to an authenticated user. Upgrade to 2024R1.1.3 or later, then review how the Nagios service account is used in your directory.
What's affected
Nagios XI versions prior to 2024R1.1.3 are affected, according to the NVD record and the VulnCheck advisory. The disclosure happens under certain circumstances that the advisory does not spell out, and it requires an authenticated user.
The fix is 2024R1.1.3 or later. The record scores the flaw at 9.8, although the advisory text says the user must already be authenticated.
Note the gap between the score and the wording. NVD lists no privileges required, while the description says an authenticated user. Plan for the worse reading.
How to check if you're exposed
Nagios XI shows its version in the web interface after login, and on a default Linux install the version file can be read from the shell:
grep full /usr/local/nagiosxi/var/xiversion
If the output shows a release older than the fixed version above, treat the server as affected. If the path differs on your install, use the version shown in the Nagios XI web interface or follow the steps in the vendor changelog.
Then find out whether your Nagios XI server is joined to Active Directory or LDAP. If it is not, the leaked token has nothing to point at. If it is, look at what the service account can do in the directory.
What to do now
- Upgrade Nagios XI to 2024R1.1.3 or later.
- If the server uses AD or LDAP authentication, rotate the credential or token that Nagios uses to bind to the directory.
- Reduce that service account to read-only access with the narrowest scope the integration needs.
- Alert on logins by that account from any host other than the Nagios server.
- Review which accounts can sign in to Nagios XI and remove stale ones.
Why it matters
The class is CWE-497, exposure of sensitive system information to an unauthorized control sphere. The software hands a secret to a user who should never see it. The secret here is the credential that ties the monitoring server to the directory.
A directory credential can matter far beyond one application. The NVD description lists domain-wide authentication misuse, privilege escalation and further compromise of network-integrated systems. How far an attacker gets depends on what rights that account holds, which is why trimming its rights is as important as patching.
Quick check
Which credential should I rotate?
The one Nagios XI uses to talk to Active Directory or LDAP. Rotate it after upgrading so a token seen before the patch is useless.
Sources
Last reviewed: 19 October 2026.
