CVE-2025-61909
Icinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemon user
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Icinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemon user
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
- Record
CVE-2025-61909- CVSS 4.0
- 4.0 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H - Weakness
- CWE-250
- Updated
- 2026-11-02
EUVDEUVD-2025-34791
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
- Record
EUVD-2025-34791- CVSS 4.0
- 4.0 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H - Updated
- 2026-11-02
NVD
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
- Record
CVE-2025-61909- CVSS 4.0
- 4.0 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-250
- Updated
- 2026-11-02
OSV
Icinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemon user
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
- Record
CVE-2025-61909- CVSS 4.0
- 4.0 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H - Weakness
- CWE-250
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-61909
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
- Record
DEBIAN-CVE-2025-61909- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-61909
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
- Record
UBUNTU-CVE-2025-61909- CVSS 4.0
- 4.0 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H - CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15644-1 No score
icinga2-2.15.1-1.1 on GA media
These are all security issues fixed in the icinga2-2.15.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15644-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
icinga2Debian:12 |
All versions, plus listed versions 2.13.6-22.13.6-2+deb12u12.13.6-2+deb12u22.13.7-12.13.7-1~exp1 Show 27 moreShow less2.13.8-12.14.0-1~exp12.14.1-12.14.2-12.14.2-1+loong642.14.3-12.14.4-12.14.5-12.14.6-12.15.0-12.15.0-1~exp12.15.1-12.15.2-12.15.2-22.16.0-12.16.0-22.16.0-3~exp12.16.0-3~exp22.16.0-3~exp32.16.0-3~exp42.16.1-12.16.1-1~exp12.16.2-12.16.2-22.16.3-12.16.4-12.16.5-1 |
None known |
icinga2Debian:13 |
before 2.14.6-1+deb13u1, plus listed versions 2.14.6-1 |
2.14.6-1+deb13u1 |
icinga2Debian:14 |
before 2.15.1-1, plus listed versions 2.14.6-12.15.0-12.15.0-1~exp1 |
2.15.1-1 |
icinga2Ubuntu:16.04:LTS |
All versions, plus listed versions 2.3.8-1build12.3.11-12.4.0-12.4.1-12.4.1-22.4.1-2ubuntu1 |
None known |
icinga2Ubuntu:18.04:LTS |
All versions, plus listed versions 2.7.0-12.8.1-0ubuntu2 |
None known |
icinga2Ubuntu:20.04:LTS |
All versions, plus listed versions 2.10.5-1build12.11.2-12.11.2-1ubuntu12.11.2-1ubuntu22.11.2-1ubuntu3 |
None known |
icinga2Ubuntu:22.04:LTS |
All versions, plus listed versions 2.12.3-12.13.1-12.13.2-12.13.2-1build12.13.2-1build2 |
None known |
icinga2Ubuntu:24.04:LTS |
All versions, plus listed versions 2.13.8-12.14.1-12.14.2-12.14.2-1build12.14.2-1build2 |
None known |
icinga2Ubuntu:25.10 |
All versions, plus listed versions 2.14.5-12.14.6-12.15.0-1 |
None known |
icinga2Ubuntu:26.04:LTS |
All versions, plus listed versions 2.15.0-12.15.1-1 |
None known |
icinga2openSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 2.15.1-1.1 | 2.15.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-61909 is a medium vulnerability (CVSS 4.0) in Icinga, published October 16, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in icinga2 2.14.6-1+deb13u1.
References
github.com/Icinga/icinga2/security/advisories/GHSA-pg6g-g99v-mw46
icinga.com/blog/releasing-icinga-2-v2-15-1-2-14-7-and-2-13-13-and-icinga-db-web-v1-2-3-and-1-1-4
nvd.nist.gov/vuln/detail/CVE-2025-61909