CVE-2025-61908

Icinga 2 from 2.8 to 2.14.9, 2.15.4, and 2.16.2 has a vulnerability in certificate update JSON-RPC message handling where the sender is not validated as a trusted endpoint. An unauthenticated attacker with access to TCP port 5665 can replace the node certificate and CA certificate, impersonate a trusted node, and take control.

Icinga 2 from 2.4 until 2.14.9, 2.15.4, and 2.16.2 writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, create additional objects, and exceed the user's assigned privileges.

Icinga 2 prior to 2.14.9, 2.15.4, and 2.16.2 does not bound JSON nesting depth, allowing deeply nested JSON to exhaust the call stack. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port 5665, allowing a remote attacker to crash the process.

Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not be permitted to. A fix is included in versions 2.15.1, 2.14.7, and 2.13.13.

Icinga 2 versions 2.4 through 2.15.0 allow authenticated API users to access variables and objects that should be hidden, including global variables and objects not permitted by permissions. Fixed in 2.15.1, 2.14.7, and 2.13.13.