CVE-2025-61907: Icinga 2 Information Disclosure Vulnerability

CVE-2025-61907 Overview

CVE-2025-61907 is an information disclosure vulnerability in Icinga 2, an open source monitoring system. Filter expressions passed to the /v1/objects API endpoints can access variables and objects that should be restricted by the caller's permissions. Authenticated API users can read global variables outside the variables permission scope and query objects outside the objects/query permission scope. The flaw affects Icinga 2 versions 2.4 through 2.15.0 and is tracked under CWE-200: Exposure of Sensitive Information. Fixed releases are 2.15.1, 2.14.7, and 2.13.13.

Critical Impact
Authenticated API users can extract sensitive configuration data, including secrets stored in global variables such as TicketSalt, bypassing the monitoring system's permission model.

Affected Products

Icinga 2 versions 2.4 through 2.13.12
Icinga 2 versions 2.14.0 through 2.14.6
Icinga 2 version 2.15.0

Discovery Timeline

2025-10-16 - CVE-2025-61907 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61907

Vulnerability Analysis

Icinga 2 exposes REST endpoints under /v1/objects that accept filter expressions written in the Icinga DSL. These expressions execute inside a ScriptFrame that determines which globals and objects are visible to the caller. In affected releases, the frame used for filter evaluation did not consistently enforce the variables and objects/query permissions attached to the API user.

As a result, an authenticated user with any API token could craft a filter that references privileged globals or queries objects outside their permission scope. The server evaluated these expressions and returned data derived from restricted values, disclosing configuration state that should have remained hidden. Sensitive globals such as TicketSalt, used to sign agent enrollment tickets, fall within reach of this flaw.

Root Cause

The ScriptFrame constructor used for filter evaluation assigned Self to the global namespace without attaching a permission checker. The patch adds a dedicated ScriptPermissionChecker component and a distinct Globals reference so that variable and object access can be gated against the caller's permissions rather than the ambient global scope.

Attack Vector

Exploitation requires network access to the Icinga 2 API and valid credentials for any API user. The attacker sends a GET or POST request to an endpoint such as /v1/objects/hosts with a crafted filter parameter that references restricted globals or objects. No user interaction is required, and the attack does not modify data — impact is limited to confidentiality.

cpp

// Patch excerpt: lib/base/scriptframe.cpp
// The fixed ScriptFrame constructors now attach a PermChecker and
// track the Globals namespace separately from Self.

ScriptFrame::ScriptFrame(bool allocLocals)
	: Locals(allocLocals ? new Dictionary() : nullptr), PermChecker(new ScriptPermissionChecker),
	  Self(ScriptGlobal::GetGlobals()), Sandboxed(false), Depth(0), Globals(nullptr)
{
	InitializeFrame();
}

ScriptFrame::ScriptFrame(bool allocLocals, Value self)
	: Locals(allocLocals ? new Dictionary() : nullptr), PermChecker(new ScriptPermissionChecker), Self(std::move(self)),
	  Sandboxed(false), Depth(0), Globals(nullptr)
{
	InitializeFrame();
}

// Source: https://github.com/Icinga/icinga2/commit/56255ac7a689b9e198742d2fca6f7459a54c85a3

Source: Icinga 2 fix commit 56255ac

Detection Methods for CVE-2025-61907

Indicators of Compromise

Authenticated /v1/objects/* requests containing filter parameters that reference global identifiers such as TicketSalt, NodeName, or ApiListener.
API access log entries from low-privilege users returning object types their ApiUser role does not list under objects/query.
Repeated filter queries from a single API token that iterate over global variables or enumerate object namespaces.

Detection Strategies

Review Icinga 2 API access logs for filter expressions that reference variables the calling ApiUser is not permitted to read.
Baseline normal API consumers and alert on new tokens issuing filter-based enumeration against /v1/objects endpoints.
Correlate 200-response API calls with the ApiUser permission set to flag responses that appear to contain data outside declared scopes.

Monitoring Recommendations

Forward Icinga 2 API and audit logs to a centralized log platform and retain them for post-incident analysis.
Enable verbose logging on the ApiListener feature during triage to capture full filter expressions submitted by clients.
Track the version reported by each Icinga 2 node so unpatched instances are visible in asset inventory.

How to Mitigate CVE-2025-61907

Immediate Actions Required

Upgrade Icinga 2 to version 2.15.1, 2.14.7, or 2.13.13 as documented in GHSA-gg32-w9rm-vp2v.
Rotate TicketSalt and any secrets stored as Icinga global variables that could have been read through the API.
Audit existing ApiUser objects and remove tokens that no longer need /v1/objects access.

Patch Information

The fix is delivered in Icinga 2 releases 2.15.1, 2.14.7, and 2.13.13. The upstream commit 56255ac7a689b9e198742d2fca6f7459a54c85a3 introduces a ScriptPermissionChecker and tracks the globals namespace separately so filter evaluation respects ApiUser permissions. Refer to the Icinga 2 fix commit and the GitHub Security Advisory for full details.

Workarounds

Restrict network access to the Icinga 2 API listener (default TCP 5665) to trusted management hosts only.
Reduce the number of ApiUser accounts and grant only the minimum permissions needed for each integration.
Terminate the API behind a reverse proxy that enforces authentication and rate limiting until patching is complete.

bash

# Verify installed Icinga 2 version and upgrade on Debian/Ubuntu
icinga2 --version

sudo apt update
sudo apt install --only-upgrade icinga2
sudo systemctl restart icinga2

# Confirm the fixed version is running
icinga2 --version | head -n 1