CVE-2025-61909
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not be permitted to. A fix is included in versions 2.15.1, 2.14.7, and 2.13.13.
Risk Assessment
The risk involves the possibility of privilege escalation by the Icinga user, who can send signals to system processes, potentially leading to system disruption or unauthorized access.
Recommendation
It is recommended to immediately upgrade Icinga 2 to version 2.15.1, 2.14.7, or 2.13.13, which include fixes for this vulnerability.
Other vulnerabilities in Icinga 2
See all- CVE-2026-61550Critical
Icinga 2 from 2.8 to 2.14.9, 2.15.4, and 2.16.2 has a vulnerability in certificate update JSON-RPC message handling where the sender is not validated as a trusted endpoint. An unauthenticated attacker with access to TCP port 5665 can replace the node certificate and CA certificate, impersonate a trusted node, and take control.
- CVE-2026-61552High
Icinga 2 from 2.4 until 2.14.9, 2.15.4, and 2.16.2 writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, create additional objects, and exceed the user's assigned privileges.
- CVE-2026-61551High
Icinga 2 prior to 2.14.9, 2.15.4, and 2.16.2 does not bound JSON nesting depth, allowing deeply nested JSON to exhaust the call stack. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port 5665, allowing a remote attacker to crash the process.
- CVE-2025-61908Medium
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, when creating an invalid reference, such as a reference to null, dereferencing results in a segmentation fault. Any API user with access to an API endpoint that allows specifying a filter expression can crash the Icinga 2 daemon.
- CVE-2025-61907Medium
Icinga 2 versions 2.4 through 2.15.0 allow authenticated API users to access variables and objects that should be hidden, including global variables and objects not permitted by permissions. Fixed in 2.15.1, 2.14.7, and 2.13.13.
Original NVD description (English source)
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS