CVE-2026-61550

Icinga 2: Improper access control for JSON-RPC update certificate messages

9.8 CriticalFix available

CVE-2026-61550 is a critical vulnerability (CVSS 9.8) in Icinga Icinga2, published September 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in icinga2 2.14.6-1+deb13u1.

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and trusted CA certificate, impersonate a trusted node, and take control of the node. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.67%Up 0.3 points since Sep 19, 2026

What each source reports

CVE List Score used 9.8

Icinga 2: Improper access control for JSON-RPC update certificate messages

Record: CVE-2026-61550
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-862
Updated: 2026-11-02

EUVDEUVD-2026-83208 9.8

Record: EUVD-2026-83208
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

NVD 9.8

Record: CVE-2026-61550
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-862
Updated: 2026-11-02

OSV 9.8

Icinga 2: Improper access control for JSON-RPC update certificate messages

Record: CVE-2026-61550
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-862
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-61550 9.8

Record: DEBIAN-CVE-2026-61550
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-61550 9.8

Record: UBUNTU-CVE-2026-61550
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

icinga icinga2

Affected packages

Affected packages
Package	Affected	Fixed
`icinga2` Debian:12	All versions, plus listed versions 2.13.6-22.13.6-2+deb12u12.13.6-2+deb12u22.13.7-12.13.7-1~exp1 Show 27 moreShow less 2.13.8-12.14.0-1~exp12.14.1-12.14.2-12.14.2-1+loong642.14.3-12.14.4-12.14.5-12.14.6-12.15.0-12.15.0-1~exp12.15.1-12.15.2-12.15.2-22.16.0-12.16.0-22.16.0-3~exp12.16.0-3~exp22.16.0-3~exp32.16.0-3~exp42.16.1-12.16.1-1~exp12.16.2-12.16.2-22.16.3-12.16.4-12.16.5-1	None known
`icinga2` Debian:13	before 2.14.6-1+deb13u1, plus listed versions 2.14.6-1	2.14.6-1+deb13u1
`icinga2` Debian:14	before 2.16.2-1, plus listed versions 2.14.6-12.15.0-12.15.0-1~exp12.15.1-12.15.2-1 Show 9 moreShow less 2.15.2-22.16.0-12.16.0-22.16.0-3~exp12.16.0-3~exp22.16.0-3~exp32.16.0-3~exp42.16.1-12.16.1-1~exp1	2.16.2-1
`icinga2` Ubuntu:16.04:LTS	All versions, plus listed versions 2.3.8-1build12.3.11-12.4.0-12.4.1-12.4.1-22.4.1-2ubuntu1	None known
`icinga2` Ubuntu:18.04:LTS	All versions, plus listed versions 2.7.0-12.8.1-0ubuntu2	None known
`icinga2` Ubuntu:20.04:LTS	All versions, plus listed versions 2.10.5-1build12.11.2-12.11.2-1ubuntu12.11.2-1ubuntu22.11.2-1ubuntu3	None known
`icinga2` Ubuntu:22.04:LTS	All versions, plus listed versions 2.12.3-12.13.1-12.13.2-12.13.2-1build12.13.2-1build2	None known
`icinga2` Ubuntu:24.04:LTS	All versions, plus listed versions 2.13.8-12.14.1-12.14.2-12.14.2-1build12.14.2-1build2	None known
`icinga2` Ubuntu:26.04:LTS	All versions, plus listed versions 2.15.0-12.15.1-1	None known

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, NVD, OSV

References

Show 9 moreShow less