Security Flaw in Icinga PowerShell Framework Exposes Private Keys
CVE-2026-24414
What is CVE-2026-24414?
The Icinga PowerShell Framework, used for monitoring Windows environments, has a significant vulnerability in versions before 1.13.4, 1.12.4, and 1.11.2. The 'certificate' directory's permissions allow any user to read sensitive data, notably the private key of the Icinga certificate for the host. This exposure can lead to unauthorized access and compromise system security. Users must update to the fixed versions to resolve this issue and are advised to restrict access manually by updating the ACL for the relevant directories. This incident has implications beyond Icinga for Windows, as it also affects Icinga 2 with related vulnerabilities.
Affected Version(s)
icinga-powershell-framework < 1.11.2 < 1.11.2
icinga-powershell-framework >= 1.12.0, < 1.12.4 < 1.12.0, 1.12.4
icinga-powershell-framework >= 1.13.0, < 1.13.4 < 1.13.0, 1.13.4