CVE-2022-24716: Icinga Web 2

High severity, CVSS 7.5. EPSS: 89.4% chance of exploitation in the next 30 days.

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.

Affected products

• Icinga Icinga Web 2: from 2.9.0, before 2.9.6 (fixed in 2.9.6)

Published 2022-03-08. Last modified 2026-06-17.