CVE-2026-61552CWE-94code-injection

CVE-2026-61552

High · published September 18, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
59.3
In the wild
Unconfirmed
What it is

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, escape the intended object, create additional objects, and exceed the user's assigned privileges. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00901 · 59.3th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-09-18T22:17Z
References (10)
https://github.com/Icinga/icinga2/commit/125b7734e84d03f09b79d36c270152b11629a8c5 · [email protected]https://github.com/Icinga/icinga2/commit/af4b36e6464b9b214bed270a53d6474cf91eb441 · [email protected]https://github.com/Icinga/icinga2/commit/eec0d90e8303376fe772b3e4a04e3b064a44cf30 · [email protected]https://github.com/Icinga/icinga2/commit/faf0450962ad678397991cfdf041810feafa71e7 · [email protected]https://github.com/Icinga/icinga2/pull/10910 · [email protected]https://github.com/Icinga/icinga2/releases/tag/v2.14.9 · [email protected]https://github.com/Icinga/icinga2/releases/tag/v2.15.4 · [email protected]https://github.com/Icinga/icinga2/releases/tag/v2.16.2 · [email protected]https://github.com/Icinga/icinga2/security/advisories/GHSA-jgqj-x5j9-vgcm · [email protected]https://icinga.com/blog/icinga2-security-release-v2-16-2 · [email protected]
EPSS history
Timeline
  • 20 SEP 03:23Z
    EPSS moved — → 1%
    epss
  • 18 SEP 17:24Z
    Icinga 2 DSL Injection via Unescaped Import Template Name
    cvelistv5