Input validation error in Icinga - CVE-2026-61552
Published: June 29, 2026 / Updated: September 22, 2026
Vulnerability identifier: #VU135837
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-61552
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper input validation in the /v1/objects API endpoint when writing template names to generated configuration files. A remote privileged user can submit a specially crafted request to escalate privileges.
Exploitation is limited to API users with permission to create configuration objects.
Affected software
Icinga
Debian Linux
icinga2 (Debian package)
Debian Linux
icinga2 (Debian package)
How to mitigate CVE-2026-61552
Install security update from vendor's website.
Icinga - addressed in versions 2.14.9, 2.15.4, 2.16.2
icinga2 (Debian package) - update to 2.14.6-1+deb13u1
icinga2 (Debian package) - update to 2.14.6-1+deb13u1