CVE-2026-61550
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
Icinga 2 from 2.8 to 2.14.9, 2.15.4, and 2.16.2 has a vulnerability in certificate update JSON-RPC message handling where the sender is not validated as a trusted endpoint. An unauthenticated attacker with access to TCP port 5665 can replace the node certificate and CA certificate, impersonate a trusted node, and take control.
Risk Assessment
An attacker can take control of a monitoring node, potentially leading to compromise of monitoring data integrity and further attacks in the infrastructure.
Recommendation
Upgrade Icinga 2 to version 2.14.9, 2.15.4, or 2.16.2. Restrict access to port 5665 to trusted clients only.
Other vulnerabilities in Icinga 2
See all- CVE-2026-61552High
Icinga 2 from 2.4 until 2.14.9, 2.15.4, and 2.16.2 writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, create additional objects, and exceed the user's assigned privileges.
- CVE-2026-61551High
Icinga 2 prior to 2.14.9, 2.15.4, and 2.16.2 does not bound JSON nesting depth, allowing deeply nested JSON to exhaust the call stack. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port 5665, allowing a remote attacker to crash the process.
- CVE-2025-61909Medium
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not be permitted to. A fix is included in versions 2.15.1, 2.14.7, and 2.13.13.
- CVE-2025-61908Medium
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, when creating an invalid reference, such as a reference to null, dereferencing results in a segmentation fault. Any API user with access to an API endpoint that allows specifying a filter expression can crash the Icinga 2 daemon.
- CVE-2025-61907Medium
Icinga 2 versions 2.4 through 2.15.0 allow authenticated API users to access variables and objects that should be hidden, including global variables and objects not permitted by permissions. Fixed in 2.15.1, 2.14.7, and 2.13.13.
Original NVD description (English source)
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and trusted CA certificate, impersonate a trusted node, and take control of the node. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS