CVE-2026-61552

Icinga 2 , an open source monitoring and alerting system, is affected by a DSL injection vulnerability in the /v1/objects API . The root cause is that attacker-controlled template names are written into generated configuration without escaping , allowing an authenticated ApiUser with an objects/c...

CVE-2026-61551 Icinga 2: Stack overflow via deeply nested JSON objects

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port...

CVE-2026-61551

Icinga 2 , an open source monitoring system, is affected by a stack overflow in its JSON parsing paths prior to versions 2.14.9 , 2.15.4 , and 2.16.2 . The root cause is that nesting depth is not bounded, so deeply nested JSON objects exhaust the call stack. The vulnerable paths are reachable by ...

CVE-2026-61551 Icinga 2: Stack overflow via deeply nested JSON objects

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port...

EUVD-2026-83209

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port...

CVE-2026-61550 Icinga 2: Improper access control for JSON-RPC update certificate messages

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-61550

Icinga 2 (open source monitoring system) is vulnerable to improper access control in its JSON-RPC certificate update message handling (affected: 2.8 through 2.14.9, 2.15.4, and 2.16.2 ). The handler does not validate that the sender is a trusted endpoint, allowing an unauthenticated attacker with...

CVE-2026-61550 Icinga 2: Improper access control for JSON-RPC update certificate messages

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-61550 Icinga 2: Improper access control for JSON-RPC update certificate messages

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-61550

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

EUVD-2026-83208

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-61552: Improper Control of Generation of Code

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/ permission can inject Icinga 2 DSL...

CVE-2026-61551: Uncontrolled Recursion

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port...

CVE-2026-61550: Missing Authorization

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-73974

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test treated the...

CVE-2026-52817

In Linuxfabrik Monitoring Plugins prior to 5.1.0, the Debian.sudoers file allowed the nagios/icinga account to run /usr/bin/apt-get as root with unrestricted arguments. An attacker with the monitoring account can execute sudo apt-get update -o APT::Update::Pre-Invoke::="/bin/sh" to obtain a root ...

PT-2026-80170

Name of the Vulnerable Software and Affected Versions Icinga 2 versions prior to 2.14.9 Icinga 2 versions prior to 2.15.4 Icinga 2 versions prior to 2.16.2 Description Parsing deeply nested JSON can exhaust the call stack because the nesting depth is not bounded. This issue is reachable by...

PT-2026-80169

Name of the Vulnerable Software and Affected Versions Icinga 2 versions 2.8 through 2.14.8 Icinga 2 versions 2.15.0 through 2.15.3 Icinga 2 versions 2.16.0 through 2.16.1 Description Certificate update JSON-RPC message handling fails to validate whether the sender is a trusted endpoint. An...

PT-2026-80171

Name of the Vulnerable Software and Affected Versions Icinga 2 versions 2.4 through 2.14.8 Icinga 2 versions 2.15.0 through 2.15.3 Icinga 2 versions 2.16.0 through 2.16.1 Description The /v1/objects API endpoint writes template names provided by the user into the generated configuration without...

EUVD-2026-50554

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish- plugins built request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, allowing a malicious or...