Permission Oversight in Icinga 2 Monitoring System Affects Windows Installations
CVE-2026-24413
6.8MEDIUM
What is CVE-2026-24413?
The Icinga 2 monitoring system for Windows has a permissions configuration issue that allows local users to read sensitive contents, including user private keys and configuration files, due to inadequate access control settings on the '%ProgramData%\icinga2\var' directory. This flaw affects all versions on Windows prior to 2.13.14, 2.14.8, and 2.15.2. To remediate the vulnerability, users are advised to either upgrade to the latest versions or manually adjust the Access Control Lists (ACLs) for the specified directories to limit access strictly to the Icinga service user and administrators.
Affected Version(s)
icinga2 >= 2.3.0, < 2.13.14 < 2.3.0, 2.13.14
icinga2 >= 2.14.0, < 2.14.8 < 2.14.0, 2.14.8
icinga2 >= 2.15.0, < 2.15.2 < 2.15.0, 2.15.2