anonhaven

CVE-2026-61552

HIGH CVSS 3.1: 7.2 EPSS 0.90%
Updated Sep 25, 2026
Icinga
Parameter Value
CVSS 7.2 (HIGH)
Type CWE-94 (Code Injection)
Vendor Icinga
Public PoC No

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, escape the intended object, create additional objects, and exceed the user's assigned privileges.

This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service

CVSS Vector v3.1

Weakness Type (CWE)

CWE-94 Code Injection

Vulnerable Products

icinga:icinga2

References 10

https://github.com/Icinga/icinga2/security/advisories/GHSA-jgqj-x5j9-vgcm
https://github.com/Icinga/icinga2/security/advisories/GHSA-jgqj-x5j9-vgcm
https://github.com/Icinga/icinga2/pull/10910
https://github.com/Icinga/icinga2/pull/10910
https://github.com/Icinga/icinga2/commit/125b7734e84d03f09b79d36c270152b11629a8…
https://github.com/Icinga/icinga2/commit/125b7734e84d03f09b79d36c270152b11629a8c5
https://github.com/Icinga/icinga2/commit/af4b36e6464b9b214bed270a53d6474cf91eb4…
https://github.com/Icinga/icinga2/commit/af4b36e6464b9b214bed270a53d6474cf91eb441
https://github.com/Icinga/icinga2/commit/eec0d90e8303376fe772b3e4a04e3b064a44cf…
https://github.com/Icinga/icinga2/commit/eec0d90e8303376fe772b3e4a04e3b064a44cf30
https://github.com/Icinga/icinga2/commit/faf0450962ad678397991cfdf041810feafa71…
https://github.com/Icinga/icinga2/commit/faf0450962ad678397991cfdf041810feafa71e7
https://github.com/Icinga/icinga2/releases/tag/v2.14.9
https://github.com/Icinga/icinga2/releases/tag/v2.14.9
https://github.com/Icinga/icinga2/releases/tag/v2.15.4
https://github.com/Icinga/icinga2/releases/tag/v2.15.4
https://github.com/Icinga/icinga2/releases/tag/v2.16.2
https://github.com/Icinga/icinga2/releases/tag/v2.16.2
https://icinga.com/blog/icinga2-security-release-v2-16-2
https://icinga.com/blog/icinga2-security-release-v2-16-2
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-61551

Icinga

8.6

CVE-2026-61550

Icinga

9.8