Icinga 2 fixes a critical vulnerability

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Icinga 2 fixes a critical vulnerability

Icinga versions 2.14.6, 2.13.12 and 2.12.12 fix a critical vulnerability in Icinga 2 [1].

Icinga 2 - node impersonation (CVE-2025-48057)

CVSS 9.3 (Critical)

An unauthenticated remote attacker can issue a valid certificate using a specially crafted certificate request, which the system incorrectly evaluates as a renewal of an existing trusted certificate, and thus potentially act as a legitimate node of the Icinga 2 infrastructure. The vulnerability affects systems using the OpenSSL library older than version 1.1.0 and can be exploited only through a direct TLS connection to a master server that is authorized to issue certificates [1]. If an immediate update to the fixed version is not possible, the recommended workaround is to restrict network access to master servers to trusted entities only, or to disable the ability to issue new certificates – for example by renaming the directory /var/lib/icinga2/ca. More detailed information about the vulnerability is available at [1].

The vulnerability is present in product:

*:Icinga 2; <2.12.12; >=2.13.0, <2.13.12; >=2.14.0, <2.14.6;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

More information:

CVE-2025-48057 at cve.org, NVD
CWE-296: Improper Following of a Certificate's Chain of Trust at cwe.mitre.org

The vulnerability was publicly disclosed 27. 5. 2025.

Report feedback

[TLP:CLEAR] Icinga 2 fixes a critical vulnerability

Icinga 2 - node impersonation (CVE-2025-48057)

CVSS 9.3 (Critical)

Links