DEBIAN-CVE-2026-61550
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-61550
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-61550.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-61550
- Upstream
- Published
- 2026-09-18T18:17:08Z
- Modified
- 2026-09-19T05:00:10Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and trusted CA certificate, impersonate a trusted node, and take control of the node. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.
- References
Affected packages
Debian:12 / icinga2
Package
- Name
- icinga2
- Purl
- pkg:deb/debian/icinga2?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
2.*
2.13.6-2
2.13.6-2+deb12u1
2.13.6-2+deb12u2
2.13.7-1~exp1
2.13.7-1
2.13.8-1
2.14.0-1~exp1
2.14.1-1
2.14.2-1
2.14.2-1+loong64
2.14.3-1
2.14.4-1
2.14.5-1
2.14.6-1
2.15.0-1~exp1
2.15.0-1
2.15.1-1
2.15.2-1
2.15.2-2
2.16.0-1
2.16.0-2
2.16.0-3~exp1
2.16.0-3~exp2
2.16.0-3~exp3
2.16.0-3~exp4
2.16.1-1~exp1
2.16.1-1
2.16.2-1
2.16.2-2
2.16.3-1
2.16.4-1
2.16.5-1
Debian:13 / icinga2
Package
- Name
- icinga2
- Purl
- pkg:deb/debian/icinga2?arch=source&distro=trixie
Debian:14 / icinga2
Package
- Name
- icinga2
- Purl
- pkg:deb/debian/icinga2?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.16.2-1