This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-61550 →
DEBIAN-CVE-2026-61550
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validat...
Original description
The description as published by the source.
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and trusted CA certificate, impersonate a trusted node, and take control of the node. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
icinga2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
icinga2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.6-1+deb13u1"}]}]
Debian:14
icinga2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.2-1"}]}]
References
- advisory security-tracker.debian.org