Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2024-49369 EUVD-2024-43406

Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections

Published Nov 12, 2024 · Updated Nov 3, 2025 · Assigned by GitHub_M

Vendor: Icinga Product: icinga2 Package: icinga2 Package: icinga2 Ecosystem: Debian Ecosystem: Ubuntu

Description

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.

Affected products

VendorProductAffectedFixed
Icinga icinga2 >= 2.4.0, < 2.11.12, >= 2.12.0, < 2.12.11, >= 2.13.0, < 2.13.10, >= 2.14.0, < 2.14.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 icinga2 2.14.3-1 —
Debian 13 icinga2 2.14.3-1 —
Debian 12 icinga2 2.13.6-2+deb12u2 —
Debian 11 icinga2 2.12.3-1+deb11u1 DLA-3953-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS icinga2 No fix yet —
Ubuntu 22.04 LTS icinga2 No fix yet —
Ubuntu 20.04 LTS icinga2 No fix yet —
Ubuntu 18.04 LTS icinga2 No fix yet —
Ubuntu 16.04 LTS icinga2 No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Package Hub 15 SP6 icinga2 2.13.10-bp156.4.3.1 openSUSE-SU-2024:0372-1
SUSE Package Hub 15 SP5 icinga2 2.13.10-bp155.3.3.1 openSUSE-SU-2024:0371-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed icinga2 2.14.3-1.1 openSUSE-SU-2024:14493-1
openSUSE Leap 15.6 icinga2 2.13.10-bp156.4.3.1 openSUSE-SU-2024:0372-1
openSUSE Leap 15.5 icinga2 2.13.10-bp155.3.3.1 openSUSE-SU-2024:0371-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 5

References