Security Flaw in Icinga 2 Monitoring System Affecting Multiple Versions
CVE-2026-61550
9.8CRITICAL
What is CVE-2026-61550?
Icinga 2, an open-source monitoring solution, has a vulnerability in its handling of certificate update JSON-RPC messages. From versions 2.8 through 2.14.9, 2.15.4, and 2.16.2, the software fails to validate whether the sending endpoint is trusted. This allows unauthenticated attackers connected to TCP port 5665 to replace node certificates and trusted authority certificates, effectively impersonating trusted nodes and potentially taking control. This critical issue has been addressed in later versions, underscoring the importance of timely updates.
Affected Version(s)
icinga2 >= 2.8, < 2.14.9 < 2.8, 2.14.9
icinga2 >= 2.15.0, < 2.15.4 < 2.15.0, 2.15.4
icinga2 >= 2.16.0, < 2.16.2 < 2.16.0, 2.16.2