Icinga vulnerabilities
We track 12 vulnerabilities in Icinga products across 10 products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on September 18, 2026.
Latest Icinga vulnerabilities
- 7.2 High severity
icinga2: Improper Control of Generation of Code
Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permiss
- 8.6 High severity
icinga2: Uncontrolled Recursion
Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients thro
- 9.8 Critical severity
icinga2: Missing Authorization
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665
- 7.6 High severity
ipl-web: Improper Neutralization of Input During Web Page Generation
ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a spe
- 9.8 Critical severity
icinga2: Improper Following of a Certificate's Chain of Trust
Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Prior to versions 2.12.12, 2.13.12, and 2.14.6, the VerifyCertificate() function can be tricked into in
- 7.6 High severity
icingaweb2-module-reporting: Improper Neutralization of Input During Web Page Generation
Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability present in versions 0.10.0 through 1.0.2 allows to set up a template that allows to embed arbitrary Javascr
- 9.8 Critical severity
icinga2: Improper Certificate Validation
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attac
- 8.8 High severity
icingaweb2-module-incubator: Cross-Site Request Forgery
icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class `gipfl\Web\Form` is the base for various concrete form implementations [1] and provides protection against cross site request forgery (CSRF
- 8.3 High severity
icingaweb2-module-director: Cross-Site Request Forgery
Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to manipulate the monitoring environment are protected against cross site request forgery (CSRF). It enables attackers to per
- 8.8 High severity
icingaweb2-module-jira: Cross-Site Request Forgery
icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms perform the deletion action before user input is validated, including the cross site request forgery t
- 7.5 High severity
icingaweb2: Improper Limitation of a Pathname to a Restricted Directory
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database
- 8.8 High severity
icingaweb2: Improper Limitation of a Pathname to a Restricted Directory
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issu