DEBIAN-CVE-2026-61637: Low severity debian/icingaweb2 vulnerability
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. For this to succeed, the victim's locale in Icinga Web must be different from enUS. This issue has been patched in versions 2.12.7 and 2.13.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/icingaweb2to a version that resolves this vulnerability.Fixed in 2.13.1-1 - Upgrade
Upgrade
Icinga Web 2to a version that resolves this vulnerability.Fixed in 2.12.7
Event History
Frequently Asked Questions
Who is exposed to this redirect issue?
Users of Icinga Web 2 who are authenticated, or can authenticate, are exposed if their Icinga Web locale is set to something other than en_US and they visit an attacker-crafted URL.
What must an attacker do to exploit it?
The attacker must craft a URL and cause an authenticated user, or a user able to authenticate, to visit it. Exploitation depends on the victim using a locale other than en_US.
Which versions contain the fix?
The issue is patched in Icinga Web 2 versions 2.12.7 and 2.13.1.