CVE-2026-61552

NameCVE-2026-61552
DescriptionIcinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, escape the intended object, create additional objects, and exceed the user's assigned privileges. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6426-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
icinga2 (PTS)bookworm2.13.6-2+deb12u2vulnerable
trixie2.14.6-1vulnerable
trixie (security)2.14.6-1+deb13u1fixed
forky, sid2.16.5-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
icinga2sourcetrixie2.14.6-1+deb13u1DSA-6426-1
icinga2source(unstable)2.16.2-1

Notes

https://github.com/Icinga/icinga2/security/advisories/GHSA-jgqj-x5j9-vgcm
https://icinga.com/blog/icinga2-security-release-v2-16-2/
Fixed by: https://github.com/Icinga/icinga2/commit/af4b36e6464b9b214bed270a53d6474cf91eb441 (v2.16.2)
Fixed by: https://github.com/Icinga/icinga2/commit/eec0d90e8303376fe772b3e4a04e3b064a44cf30 (v2.14.9)

Search for package or bug name: Reporting problems