Every CVE Search/ Get API key

CVE-2024-49369

Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections

9.8 CriticalPublic exploitFix available

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.94%Up 2.9 points since Nov 13, 2024
90%50%10%1%

What each source reports

CVE List Score used 9.8

Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.

Record
CVE-2024-49369
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-295
Updated
2026-11-02
EUVDEUVD-2024-43406 9.8

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.

Record
EUVD-2024-43406
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
NVD 9.8

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.

Record
CVE-2024-49369
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-295
Updated
2026-11-02
OSV 9.8

Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.

Record
CVE-2024-49369
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-295
Updated
2026-11-02
OSVDEBIAN-CVE-2024-49369 9.8

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.

Record
DEBIAN-CVE-2024-49369
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-49369 9.8

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.

Record
UBUNTU-CVE-2024-49369
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:0371-1 No score

Security update for icinga2

This update for icinga2 fixes the following issues:

Update to 2.13.10:

  • CVE-2024-49369: Fix TLS certificate validation bypass (bsc#1233310).
Record
openSUSE-SU-2024:0371-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:0372-1 No score

Security update for icinga2

This update for icinga2 fixes the following issues:

Update to 2.13.10:

  • CVE-2024-49369: Fix TLS certificate validation bypass (bsc#1233310).
Record
openSUSE-SU-2024:0372-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14493-1 No score

icinga2-2.14.3-1.1 on GA media

These are all security issues fixed in the icinga2-2.14.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14493-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
icinga2
Debian:12
 before 2.13.6-2+deb12u2, plus listed versions
2.13.6-22.13.6-2+deb12u1
2.13.6-2+deb12u2
icinga2
Debian:13
 before 2.14.3-1
2.14.3-1
icinga2
Debian:14
 before 2.14.3-1
2.14.3-1
icinga2
Debian:11
From an advisory covering 4 CVEs
 before 2.12.3-1+deb11u1, plus listed versions
2.12.3-1
2.12.3-1+deb11u1
icinga2
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.3.8-1build12.3.11-12.4.0-12.4.1-12.4.1-22.4.1-2ubuntu1
 None known
icinga2
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.7.0-12.8.1-0ubuntu2
 None known
icinga2
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.10.5-1build12.11.2-12.11.2-1ubuntu12.11.2-1ubuntu22.11.2-1ubuntu3
 None known
icinga2
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.12.3-12.13.1-12.13.2-12.13.2-1build12.13.2-1build2
 None known
icinga2
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.13.8-12.14.1-12.14.2-12.14.2-1build12.14.2-1build2
 None known
icinga2
SUSE:Package Hub 15 SP5
 before 2.13.10-bp155.3.3.1
2.13.10-bp155.3.3.1
Show 4 moreShow less
Affected packages
PackageAffectedFixed
icinga2
openSUSE:Leap 15.5
 before 2.13.10-bp155.3.3.1
2.13.10-bp155.3.3.1
icinga2
SUSE:Package Hub 15 SP6
 before 2.13.10-bp156.4.3.1
2.13.10-bp156.4.3.1
icinga2
openSUSE:Leap 15.6
 before 2.13.10-bp156.4.3.1
2.13.10-bp156.4.3.1
icinga2
openSUSE:Tumbleweed
 before 2.14.3-1.1
2.14.3-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubQuantum-Sicarius/CVE-2024-493692024-11-29

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-49369 is a critical vulnerability (CVSS 9.8) in Icinga, published November 12, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.94%, the 87th percentile. Fixed in icinga2 2.13.6-2+deb12u2.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open