Komari: Management Interface CSRF

Published September 9, 2026 GHSA-hxjg-93wc-h8p8

Komari's admin panel can accept actions from a malicious website under certain conditions. An attacker could change settings, delete monitoring records, disable two-factor authentication, or run commands on managed systems.

Severity
HighCVSS 8.8
Fix
Fixed in 0.0.0-20260609084633-98122fa4d110Fix recorded yesterday
Affected versions
before 0.0.0-20260609084633-98122fa4d110
Affects
komari-monitor/komari

How it works

  • Komari relies on a login cookie for admin actions without adding a separate request check.
  • Older browsers, same-origin attacks, or unencrypted HTTP can allow an attacker-controlled request to carry that cookie.
  • Modern browsers usually block ordinary cross-site POST requests because of their default cookie rules.

What to do

For a Go-based installation, run go list -m -f '{{.Version}}' github.com/komari-monitor/komari and compare the result with 0.0.0-20260609084633-98122fa4d110. Versions before that fixed version are in scope; a version check does not prove that anyone used the flaw.

Update Komari to 0.0.0-20260609084633-98122fa4d110 or a later release. If your deployment uses a packaged Komari release, compare its version with the vendor advisory before updating.

Technical details

Affected software: komari-monitor/komari

The issue is a cross-site request forgery weakness in Komari's management interface. Admin endpoints rely on the session_token cookie without CSRF-token or Origin checks, while the cookie lacks explicit SameSite and Secure settings. Modern browsers generally reduce ordinary cross-site exposure, but older browsers, same-origin compromise, and HTTP connections remain relevant.

References

View Original Source