API Configuration Injection in Icinga 2 Monitoring System
CVE-2026-61552
7.2HIGH
What is CVE-2026-61552?
Icinga 2, an open source monitoring system, is subject to a vulnerability where the /v1/objects API improperly handles attacker-controlled template names. This flaw allows authenticated users with the appropriate permissions to inject custom configuration elements into Icinga 2's DSL. Consequently, an attacker could potentially manipulate or create unauthorized objects, surpassing their permitted access levels. The issue has been addressed in subsequent releases, notably versions 2.14.9, 2.15.4, and 2.16.2, ensuring enhanced security measures.
Affected Version(s)
icinga2 >= 2.4, < 2.14.9 < 2.4, 2.14.9
icinga2 >= 2.15.0, < 2.15.4 < 2.15.0, 2.15.4
icinga2 >= 2.16.0, < 2.16.2 < 2.16.0, 2.16.2