CVE-2026-61637: Icinga Web 2: Open redirect on login page, under certain circumstances
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. For this to succeed, the victim's locale in Icinga Web must be different from enUS. This issue has been patched in versions 2.12.7 and 2.13.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Icinga Web 2to a version that resolves this vulnerability.Fixed in 2.12.7 - Upgrade
Upgrade
Icinga Web 2to a version that resolves this vulnerability.Fixed in 2.13.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Icinga Web 2 before 2.12.7 or 2.13.1 are exposed if their configured Icinga Web locale is not en_US. The victim must already be authenticated or be able to authenticate.
What does an attacker need to do to exploit it?
An attacker must craft a URL and convince an affected user to visit it. Successful exploitation relies on the user's non-en_US locale and results in a redirect to an attacker-selected location.
Are default en_US locale users affected?
The issue requires the victim's locale to differ from en_US. Users whose locale is en_US do not meet the stated condition for exploitation.
How can the issue be remediated?
Upgrade Icinga Web 2 to version 2.12.7 or 2.13.1, which include the patch. If an upgrade cannot be applied immediately, using en_US for user locales avoids the stated locale condition.