GHSA-w7c2-xjv9-q8fv: Icinga Web 2: Open redirect on login page, under certain circumstances

Published Nov 11, 2026

Updated

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. For this to succeed, the victim's locale in Icinga Web must be different from enUS. This issue has been patched in versions 2.12.7 and 2.13.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Icinga Web 2 to a version that resolves this vulnerability.
Fixed in 2.12.7
Upgrade
Upgrade Icinga Web 2 to a version that resolves this vulnerability.
Fixed in 2.13.1

Event History

Nov 11, 2026

CVE Published

via OSV·06:26 PM

Data Sourced

via OSV·06:26 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users are exposed to this redirect issue?

The issue requires a victim whose Icinga Web locale is set to something other than en_US. The victim must already be authenticated or be able to authenticate after visiting the attacker-crafted URL.

What does an attacker need to exploit it?

An attacker needs to craft a URL and persuade an eligible user to visit it. Successful exploitation redirects the user to an attacker-chosen location.

Which releases contain the fix?

The issue is patched in Icinga Web 2 versions 2.12.7 and 2.13.1. Versions earlier than those releases are affected under the stated locale and user-interaction conditions.