CVE-2024-49369criticalCWE-295

CVE-2024-49369: critical vulnerability in icinga2

Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections

Published · Updated

Follow this CVE+ Monitor icinga2+ Monitor icinga2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.8epss 2.9%
from disclosure to weapon17 days
Published on NVDNov 12
1st PoC+17d
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Icinga · icinga2
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — icinga2

In the same product, most dangerous first.

CVE-2021-32743HIGHPasswords used to access external services inadvertently exposed through APIEPSS 1.8%CVE-2021-37698HIGHMissing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2WriterEPSS 1.4%CVE-2021-32739HIGHResults of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identitiesEPSS 1.1%CVE-2026-61551HIGHIcinga 2: Stack overflow via deeply nested JSON objectsEPSS 0.9%CVE-2026-61552HIGHIcinga 2 DSL Injection via Unescaped Import Template NameEPSS 0.9%CVE-2026-61550CRITICALIcinga 2: Improper access control for JSON-RPC update certificate messagesEPSS 0.7%