CVE-2026-61552: Icinga ICINGA2

High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days.

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, escape the intended object, create additional objects, and exceed the user's assigned privileges. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.

Affected products

• Icinga ICINGA2: from 2.4, before 2.14.9 (fixed in 2.14.9); from 2.15.0, before 2.15.4 (fixed in 2.15.4); from 2.16.0, before 2.16.2 (fixed in 2.16.2)

Published 2026-09-18. Last modified 2026-09-24.