Main Vulnerability Database Vulnerabilities #VU124799

Cross-site request forgery in Cisco Nexus Dashboard Insights (NDI) and Nexus Dashboard - CVE-2026-20041

Published: April 1, 2026

Vulnerability identifier: #VU124799

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2026-20041

CWE-ID: CWE-352

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and send arbitrary network requests originating from the device on behalf of the victim.

Affected software

Cisco Nexus Dashboard Insights (NDI)
Nexus Dashboard

How to mitigate CVE-2026-20041

Install updates from vendor's website.

Cisco Nexus Dashboard Insights (NDI) - addressed in versions 4.1.0.138, 4.2.0.117, 6.7.0.185
Nexus Dashboard - update to 4.2

External References

Related Security Bulletins