CVE-2026-61552
- Source
- https://cve.org/CVERecord?id=CVE-2026-61552
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61552.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-61552
- Aliases
-
- GHSA-jgqj-x5j9-vgcm
- Downstream
- Published
- 2026-09-18T17:24:42Z
- Modified
- 2026-10-28T11:11:58Z
- Severity
-
- 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Icinga 2 DSL Injection via Unescaped Import Template Name
- Details
-
Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, escape the intended object, create additional objects, and exceed the user's assigned privileges. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-94" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61552.json" }- References
-
- https://github.com/Icinga/icinga2/releases/tag/v2.14.9
- https://github.com/Icinga/icinga2/releases/tag/v2.15.4
- https://github.com/Icinga/icinga2/releases/tag/v2.16.2
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61552.json
- https://github.com/Icinga/icinga2/security/advisories/GHSA-jgqj-x5j9-vgcm
- https://nvd.nist.gov/vuln/detail/CVE-2026-61552
- https://github.com/Icinga/icinga2/commit/125b7734e84d03f09b79d36c270152b11629a8c5
- https://github.com/Icinga/icinga2/commit/af4b36e6464b9b214bed270a53d6474cf91eb441
- https://github.com/Icinga/icinga2/commit/eec0d90e8303376fe772b3e4a04e3b064a44cf30
- https://github.com/Icinga/icinga2/commit/faf0450962ad678397991cfdf041810feafa71e7
- https://github.com/Icinga/icinga2/pull/10910
- https://icinga.com/blog/icinga2-security-release-v2-16-2
Affected packages
Git / github.com/icinga/icinga2
Affected ranges
- Type
- GIT
- Repo
- https://github.com/icinga/icinga2
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "2.4" }, { "fixed": "2.14.9" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "2.15.0" }, { "fixed": "2.15.4" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "2.16.0" }, { "fixed": "2.16.2" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "125b7734e84d03f09b79d36c270152b11629a8c5" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "af4b36e6464b9b214bed270a53d6474cf91eb441" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "eec0d90e8303376fe772b3e4a04e3b064a44cf30" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "faf0450962ad678397991cfdf041810feafa71e7" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v2.14.9", "range": [ { "fixed": "75b2d7a1c9eacb58e3e3025a6e5f4f573f922d23" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v2.15.4", "range": [ { "fixed": "b4ec974518c9e5f5ca861169442ac3780e675767" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v2.16.2", "range": [ { "fixed": "cfdf63b6331c73fecb2de433022e950cf5184d02" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
v2.*
v2.10.0
v2.10.1
v2.11.0
v2.11.0-rc1
v2.12.0
v2.12.0-rc1
v2.13.0
v2.14.0
v2.14.1
v2.14.2
v2.14.4
v2.14.5
v2.15.0
v2.15.3
v2.16.0
v2.16.1
v2.4.0
v2.5.0
v2.6.0
v2.6.1
v2.7.0
v2.9.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61552.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"59899725601018182516792911217307821527",
"129977937418125232374674937563614655038",
"71065345085471113227799827662163349187",
"279318950991862264849474981758633920510"
],
"threshold": 0.9
},
"id": "CVE-2026-61552-21c75934",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/icinga/icinga2/commit/af4b36e6464b9b214bed270a53d6474cf91eb441",
"target": {
"file": "lib/base/configwriter.hpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "267381947322668360558648684449444235221",
"length": 881
},
"id": "CVE-2026-61552-37e6bce0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/icinga/icinga2/commit/eec0d90e8303376fe772b3e4a04e3b064a44cf30",
"target": {
"file": "lib/base/configwriter.cpp",
"function": "ConfigWriter::EmitScope"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"106757867239695335712174213460390906041",
"97749299920142283549346335891331204672",
"204780741062044310861033395915111145796",
"215389316788068430871667946617824162396",
"327048152677635572200887907722822677582",
"183045592543193529424289644348787035288",
"21182394755458444494645020712612968363",
"85674943352650593287789976331583757241",
"332048325784111845672029237039027725677",
"320573121894957912360087867808230076635",
"271465232327094196450288203775352056841"
],
"threshold": 0.9
},
"id": "CVE-2026-61552-40dd5ed4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/icinga/icinga2/commit/eec0d90e8303376fe772b3e4a04e3b064a44cf30",
"target": {
"file": "lib/base/configwriter.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "60945322493185959739419995176459144129",
"length": 114
},
"id": "CVE-2026-61552-66601bee",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/icinga/icinga2/commit/125b7734e84d03f09b79d36c270152b11629a8c5",
"target": {
"file": "lib/base/configwriter.cpp",
"function": "ConfigWriter::EmitComment"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"106757867239695335712174213460390906041",
"97749299920142283549346335891331204672",
"204780741062044310861033395915111145796",
"215389316788068430871667946617824162396",
"327048152677635572200887907722822677582",
"183045592543193529424289644348787035288",
"21182394755458444494645020712612968363",
"85674943352650593287789976331583757241",
"332048325784111845672029237039027725677",
"320573121894957912360087867808230076635",
"271465232327094196450288203775352056841"
],
"threshold": 0.9
},
"id": "CVE-2026-61552-6c8eca72",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/icinga/icinga2/commit/faf0450962ad678397991cfdf041810feafa71e7",
"target": {
"file": "lib/base/configwriter.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "60945322493185959739419995176459144129",
"length": 114
},
"id": "CVE-2026-61552-7de531a6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/icinga/icinga2/commit/af4b36e6464b9b214bed270a53d6474cf91eb441",
"target": {
"file": "lib/base/configwriter.cpp",
"function": "ConfigWriter::EmitComment"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "60945322493185959739419995176459144129",
"length": 114
},
"id": "CVE-2026-61552-97acb725",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/icinga/icinga2/commit/faf0450962ad678397991cfdf041810feafa71e7",
"target": {
"file": "lib/base/configwriter.cpp",
"function": "ConfigWriter::EmitComment"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "267381947322668360558648684449444235221",
"length": 881
},
"id": "CVE-2026-61552-9bda42a2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/icinga/icinga2/commit/125b7734e84d03f09b79d36c270152b11629a8c5",
"target": {
"file": "lib/base/configwriter.cpp",
"function": "ConfigWriter::EmitScope"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"59899725601018182516792911217307821527",
"129977937418125232374674937563614655038",
"71065345085471113227799827662163349187",
"279318950991862264849474981758633920510"
],
"threshold": 0.9
},
"id": "CVE-2026-61552-a0962ac6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/icinga/icinga2/commit/eec0d90e8303376fe772b3e4a04e3b064a44cf30",
"target": {
"file": "lib/base/configwriter.hpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "267381947322668360558648684449444235221",
"length": 881
},
"id": "CVE-2026-61552-a6e2eeb5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/icinga/icinga2/commit/af4b36e6464b9b214bed270a53d6474cf91eb441",
"target": {
"file": "lib/base/configwriter.cpp",
"function": "ConfigWriter::EmitScope"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "60945322493185959739419995176459144129",
"length": 114
},
"id": "CVE-2026-61552-b9086f39",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/icinga/icinga2/commit/eec0d90e8303376fe772b3e4a04e3b064a44cf30",
"target": {
"file": "lib/base/configwriter.cpp",
"function": "ConfigWriter::EmitComment"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"59899725601018182516792911217307821527",
"129977937418125232374674937563614655038",
"71065345085471113227799827662163349187",
"279318950991862264849474981758633920510"
],
"threshold": 0.9
},
"id": "CVE-2026-61552-ba999714",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/icinga/icinga2/commit/125b7734e84d03f09b79d36c270152b11629a8c5",
"target": {
"file": "lib/base/configwriter.hpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"106757867239695335712174213460390906041",
"97749299920142283549346335891331204672",
"204780741062044310861033395915111145796",
"215389316788068430871667946617824162396",
"327048152677635572200887907722822677582",
"183045592543193529424289644348787035288",
"21182394755458444494645020712612968363",
"85674943352650593287789976331583757241",
"332048325784111845672029237039027725677",
"320573121894957912360087867808230076635",
"271465232327094196450288203775352056841"
],
"threshold": 0.9
},
"id": "CVE-2026-61552-c352d75d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/icinga/icinga2/commit/af4b36e6464b9b214bed270a53d6474cf91eb441",
"target": {
"file": "lib/base/configwriter.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"106757867239695335712174213460390906041",
"97749299920142283549346335891331204672",
"204780741062044310861033395915111145796",
"215389316788068430871667946617824162396",
"327048152677635572200887907722822677582",
"183045592543193529424289644348787035288",
"21182394755458444494645020712612968363",
"85674943352650593287789976331583757241",
"332048325784111845672029237039027725677",
"320573121894957912360087867808230076635",
"271465232327094196450288203775352056841"
],
"threshold": 0.9
},
"id": "CVE-2026-61552-c5a76988",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/icinga/icinga2/commit/125b7734e84d03f09b79d36c270152b11629a8c5",
"target": {
"file": "lib/base/configwriter.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"59899725601018182516792911217307821527",
"129977937418125232374674937563614655038",
"71065345085471113227799827662163349187",
"279318950991862264849474981758633920510"
],
"threshold": 0.9
},
"id": "CVE-2026-61552-c82d4b2d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/icinga/icinga2/commit/faf0450962ad678397991cfdf041810feafa71e7",
"target": {
"file": "lib/base/configwriter.hpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "267381947322668360558648684449444235221",
"length": 881
},
"id": "CVE-2026-61552-f3e74bd1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/icinga/icinga2/commit/faf0450962ad678397991cfdf041810feafa71e7",
"target": {
"file": "lib/base/configwriter.cpp",
"function": "ConfigWriter::EmitScope"
}
}
]
vanir_signatures_modified
"2026-10-28T11:11:58Z"