CVE-2025-34271 is a critical flaw (CVSS 9.8) in the cluster manager of Nagios Log Server. Peer nodes request sensitive credentials over an unencrypted channel even when SSL/TLS is enabled. Versions before 2024R2.0.2 are affected. Upgrade to 2024R2.0.2 or later and treat cluster credentials as exposed if the network was not trusted.
What's affected
The CVE record says Nagios Log Server versions prior to 2024R2.0.2 are affected. The fix is in 2024R2.0.2 according to the affected range in the record and the VulnCheck advisory.
The weakness sits in the cluster manager component, so the risk applies to clustered deployments where nodes talk to each other. A single node setup has no peer traffic of this kind, but the record does not say so explicitly, so confirm with the vendor if you run one node. The Nagios changelog and security disclosure pages are the place to confirm release details for your branch.
How to check if you're exposed
Start with the version. Open the Nagios Log Server web interface and look at the version shown in the footer or the About page, or follow the vendor documentation for your install. Anything older than 2024R2.0.2 is in the affected range.
Then look at the network. Credentials in transit can only be captured by someone who can see traffic between your nodes. Ask where the cluster traffic travels: a dedicated, isolated segment carries less risk than a flat network shared with user machines or other tenants. Check switch and hypervisor access for who can mirror or sniff that traffic.
If you track the software you run in an inventory or SBOM, the Gold directory entry and the free in-browser scan at gold.safeguard.sh/scan help you see which of your components carry this CVE. Appliance and server products are easy to miss, so add them to the list by hand if your scanner only reads package manifests.
What to do now
- Upgrade every node in the cluster to Nagios Log Server 2024R2.0.2 or later. Because the advisory for the next issue sets a higher floor, consider going straight to the newest release listed in the Nagios changelog.
- Rotate credentials that cluster nodes and service accounts use, if the cluster traffic crossed any network you do not fully control.
- Restrict cluster traffic to a dedicated network segment or VLAN, and allow only the node addresses that need to talk to each other.
- Review authentication logs for unfamiliar logins as a cluster node or service account, starting from the date the vulnerable version was first deployed.
- Check the Nagios security disclosures page for any later Log Server advisory that applies to your branch.
Why it matters
The weakness class is CWE-319 (Cleartext Transmission of Sensitive Information). The product offers TLS, and an administrator who turned it on would reasonably expect secrets to be protected. The advisory says that one cluster manager request path still sent credentials unencrypted regardless of that setting. That is the kind of gap a configuration review will not find, because the setting looks correct.
The attacker in this scenario sits on the network path, which sounds demanding. In a flat data center network, a shared cloud virtual network or a compromised neighbor machine, that position is more common than people assume. Stolen node or service credentials then allow authentication as part of the cluster, which the record describes as enabling lateral movement. A log platform often holds sensitive operational data, so it is worth patching promptly. The record does not flag this CVE as exploited in the wild in the CISA KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does turning on SSL/TLS in Log Server fix this?
No. The record states the credential request goes out over an unencrypted channel even when SSL/TLS is enabled in the product configuration. Only the vendor update changes that behavior.
Which version should I install?
At least 2024R2.0.2 for this CVE. Check the Nagios changelog for the current release, since related Log Server advisories have higher minimum versions.
Sources
Last reviewed: 18 October 2026.
