CVE-2026-61550 json
Icinga 2: Improper access control for JSON-RPC update certificate messages
published 2026-09-18 51 d ago modified 2026-09-24 45 d ago also EUVD-2026-83208
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and trusted CA certificate, impersonate a trusted node, and take control of the node. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.
Patch / fix
- icinga2 Debian 13 2.14.6-1+deb13u1
- icinga2 Debian 14 2.16.2-1
debian advisories DEBIAN-CVE-2026-61550
- github.com/Icinga/icinga2@4b7fb34 commit
- github.com/Icinga/icinga2@6c2e0db commit
- github.com/Icinga/icinga2@a6f7cc7 commit
- github.com/Icinga/icinga2@d37b0cf commit
- github.com/Icinga/icinga2#10907 pull request
- github.com/Icinga/icinga2/releases/tag/v2.14.9 release
- github.com/Icinga/icinga2/releases/tag/v2.15.4 release
- github.com/Icinga/icinga2/releases/tag/v2.16.2 release
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 48 d ago
Exploit prediction
0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Icinga icinga2
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
- github.com /Icinga/icinga2/pull/10907
- github.com /Icinga/icinga2/commit/4b7fb3405f4616a24b2b55e20f603a56b7dd6ad0
- github.com /Icinga/icinga2/commit/6c2e0db3819f859910a4ae265461cb51b1d2039c
- github.com /Icinga/icinga2/commit/a6f7cc7a4ef8beed023b24416106822d6940c4c0
- github.com /Icinga/icinga2/commit/d37b0cfd7d9595ae2f02fadb3d724c98d8620f81
- github.com /Icinga/icinga2/security/advisories/GHSA-vj39-ww8j-vvx5
- github.com /Icinga/icinga2/releases/tag/v2.14.9
- github.com /Icinga/icinga2/releases/tag/v2.15.4
- github.com /Icinga/icinga2/releases/tag/v2.16.2
- icinga.com /blog/icinga2-security-release-v2-16-2
Sources
- CVE List CVE-2026-61550
- NVD CVE-2026-61550
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.