This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Icinga fixes 2 vulnerabilities in various products

Icinga fixes 2 vulnerabilities in various products [1]. Products and their fixed versions: Icinga 2 - 2.15.2, 2.14.8, 2.13.14 Icinga for Windows - 1.13.4, 1.12.4, 1.11.2

Icinga 2, Icinga for Windows - unauthorized read (CVE-2026-24413)
CVSS 6.8 (Medium)

Due to incorrectly set permissions on the Icinga 2 directory, an authenticated local attacker can read the synchronized configuration and user private keys on Windows systems [1][2].

The vulnerability is present in products:

  • Icinga 2; >=2.3, <2.13.14; >=2.14, <2.14.8; >=2.15, <2.15.2;
  • Icinga for Windows; >=1.11.0, <1.11.2; >=1.12.0, <1.12.4; >=1.13.0, <1.13.4;

CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 29. 1. 2026.

Icinga for Windows - unauthorized read (CVE-2026-24414)
CVSS 6.8 (Medium)

Due to incorrectly set access permissions on directories containing certificates, an authenticated local attacker can read user private keys in Icinga for Windows [1][3].

The vulnerability is present in product:

  • Icinga for Windows; >=1.11.0, <1.11.2; >=1.12.0, <1.12.4; >=1.13.0, <1.13.4;

CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 29. 1. 2026.

By CESNET, z.s.p.o. Henrieta Paločková on 30. 1. 2026.

CESNET, z.s.p.o. Logo