Skip to content
OpenAdvisories
High WID-SEC-2026-2136 3 CVEs

Icinga: Mehrere Schwachstellen

Published Jun 29, 2026 · Updated Sep 20, 2026 · Revision 2 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Icinga ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, und um seine Privilegien zu erhöhen.

Product

Icinga ist ein Monitoring System.

Vulnerabilities 3

  • Critical 9.8
    CVE-2026-61550

    Icinga 2: Improper access control for JSON-RPC update certificate messages

    Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665…

    Icinga icinga2 icinga2 icinga2 Debian Ubuntu
  • High 8.6
    CVE-2026-61551

    Icinga 2: Stack overflow via deeply nested JSON objects

    Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients thr…

    Icinga icinga2 icinga2 icinga2 Debian Ubuntu
  • High 7.2
    CVE-2026-61552

    Icinga 2 DSL Injection via Unescaped Import Template Name

    Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permis…

    Icinga icinga2 icinga2 icinga2 Debian Ubuntu

Revision history

  1. #2

    CVE-Nummern ergänzt

  2. #1

    Initiale Fassung

References