Skip to content
Icinga Icinga2 vulnerabilities
-
icinga icinga2
Icinga 2 DSL Injection via Unescaped Import Template Name
CVE-2026-61552
Fix available
7.2 High
-
icinga icinga2
Icinga 2: Stack overflow via deeply nested JSON objects
CVE-2026-61551
Fix available
8.6 High
-
icinga icinga2
Icinga 2: Improper access control for JSON-RPC update certificate messages
CVE-2026-61550
Fix available
9.8 Critical
-
icinga, icinga icinga2 +1 more
Icinga has insecure permission of %ProgramData%\icinga2\var on Windows
CVE-2026-24413
Fix available
6.8 Medium
-
icinga, icinga icinga2 +1 more
Icinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemon user
CVE-2025-61909
Fix available
4.0 Medium
-
icinga, icinga icinga2 +1 more
Icinga 2 Denial of Service (DoS) By Dereferencing Invalid Reference
CVE-2025-61908
Fix available
7.1 High
-
icinga, icinga icinga2 +1 more
Icinga 2 API users could access restricted values in filter expressions
CVE-2025-61907
Fix available
7.1 High
-
icinga, icinga icinga2 +1 more
Icinga 2 certificate renewal might incorrectly renew an invalid certificate
CVE-2025-48057
Fix available
9.3 Critical
-
icinga, debian linux, icinga icinga2 +1 more +3 more
Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections
CVE-2024-49369
Public exploitFix available
9.8 Critical
-
icinga, debian linux, icinga icinga2 +2 more
Missing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2Writer
CVE-2021-37698
Fix available
7.5 High
-
icinga, debian linux, icinga icinga2 +2 more
Passwords used to access external services inadvertently exposed through API
CVE-2021-32743
Fix available
8.8 High
-
icinga, debian linux, icinga icinga2 +2 more
Results of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identities
CVE-2021-32739
Fix available
8.8 High