CVE-2026-61550criticalCWE-862

CVE-2026-61550: fallo crítico en icinga2

Icinga 2: Improper access control for JSON-RPC update certificate messages

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear icinga2+ Monitorear icinga2

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 0.7%
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and trusted CA certificate, impersonate a trusted node, and take control of the node. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Icinga · icinga2
CVEs relacionadas — icinga2

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-49369CRITICALIcinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API ConnectionsEPSS 2.9%CVE-2021-32743HIGHPasswords used to access external services inadvertently exposed through APIEPSS 1.8%CVE-2021-37698HIGHMissing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2WriterEPSS 1.4%CVE-2021-32739HIGHResults of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identitiesEPSS 1.1%CVE-2026-61551HIGHIcinga 2: Stack overflow via deeply nested JSON objectsEPSS 0.9%CVE-2026-61552HIGHIcinga 2 DSL Injection via Unescaped Import Template NameEPSS 0.9%