FKIE_CVE-2026-61552

Vulnerability from fkie_nvd - Published: 2026-09-18 18:17 - Updated: 2026-09-24 21:17
Severity
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, escape the intended object, create additional objects, and exceed the user's assigned privileges. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.
References
security-advisories@github.comhttps://github.com/Icinga/icinga2/commit/125b7734e84d03f09b79d36c270152b11629a8c5
security-advisories@github.comhttps://github.com/Icinga/icinga2/commit/af4b36e6464b9b214bed270a53d6474cf91eb441
security-advisories@github.comhttps://github.com/Icinga/icinga2/commit/eec0d90e8303376fe772b3e4a04e3b064a44cf30
security-advisories@github.comhttps://github.com/Icinga/icinga2/commit/faf0450962ad678397991cfdf041810feafa71e7
security-advisories@github.comhttps://github.com/Icinga/icinga2/pull/10910
security-advisories@github.comhttps://github.com/Icinga/icinga2/releases/tag/v2.14.9
security-advisories@github.comhttps://github.com/Icinga/icinga2/releases/tag/v2.15.4
security-advisories@github.comhttps://github.com/Icinga/icinga2/releases/tag/v2.16.2
security-advisories@github.comhttps://github.com/Icinga/icinga2/security/advisories/GHSA-jgqj-x5j9-vgcm
security-advisories@github.comhttps://icinga.com/blog/icinga2-security-release-v2-16-2
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "icinga2",
          "vendor": "Icinga",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.4, \u003c 2.14.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.15.0, \u003c 2.15.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.16.0, \u003c 2.16.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, escape the intended object, create additional objects, and exceed the user\u0027s assigned privileges. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2."
    }
  ],
  "id": "CVE-2026-61552",
  "lastModified": "2026-09-24T21:17:43.237",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-61552",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-18T18:05:25.228828Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-18T18:17:09.263",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Icinga/icinga2/commit/125b7734e84d03f09b79d36c270152b11629a8c5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Icinga/icinga2/commit/af4b36e6464b9b214bed270a53d6474cf91eb441"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Icinga/icinga2/commit/eec0d90e8303376fe772b3e4a04e3b064a44cf30"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Icinga/icinga2/commit/faf0450962ad678397991cfdf041810feafa71e7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Icinga/icinga2/pull/10910"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Icinga/icinga2/releases/tag/v2.14.9"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Icinga/icinga2/releases/tag/v2.15.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Icinga/icinga2/releases/tag/v2.16.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Icinga/icinga2/security/advisories/GHSA-jgqj-x5j9-vgcm"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://icinga.com/blog/icinga2-security-release-v2-16-2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.