CVE-2025-34274

The built-in Logstash process, which is a network service accepting potentially untrusted input, runs with the highest system privileges (root). An attacker can compromise it through various methods: by exploiting vulnerabilities in unsafe plugins, injecting pipeline configuration, or exploiting vulnerabilities in input data parsing mechanisms. Since Logstash accepts data from the network and can load external vendor components, the attack surface is extensive. After successful compromise of the Logstash process, any executed code automatically runs with root privileges.

An attacker who gains control over the Logstash process can execute arbitrary code with root privileges, leading to complete compromise of the operating system — including reading and modifying all data, installing backdoors, and lateral movement within the network.

Update Nagios Log Server to version 2024R2.0.3 or later. In this version, the Logstash service has been changed to run under the unprivileged 'nagios' user account instead of root. Details of the fix are available in the vendor's official changelog and on the Nagios security page.

Nagios Log Server in versions earlier than 2024R2.0.3