CVE-2026-61552: Icinga 2 DSL Injection via Unescaped Import Template Name
Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/ permission can inject Icinga 2 DSL configuration, escape the intended object, create additional objects, and exceed the user's assigned privileges. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
icinga2to a version that resolves this vulnerability.Fixed in 2.14.9 - Upgrade
Upgrade
icinga2to a version that resolves this vulnerability.Fixed in 2.15.4 - Upgrade
Upgrade
icinga2to a version that resolves this vulnerability.Fixed in 2.16.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Icinga 2 versions from 2.4 through the affected releases before 2.14.9, 2.15.4, and 2.16.2 are exposed when an authenticated ApiUser has an objects/create/* permission and can reach the /v1/objects API.
What access does an attacker need to exploit this issue?
An attacker needs valid authentication as an ApiUser with objects/create/* permission. No user interaction is required, and the attacker can supply a malicious template name through the API.
What can a successful attacker do?
The attacker can inject Icinga 2 DSL into generated configuration, escape the intended object definition, and create additional objects. This can allow the attacker to exceed the privileges assigned to that ApiUser.
Which versions contain the fix?
The issue is fixed in Icinga 2 versions 2.14.9, 2.15.4, and 2.16.2.