CVE-2026-61552: Icinga 2 Privilege Escalation Vulnerability

CVE-2026-61552 Overview

CVE-2026-61552 is a code injection vulnerability [CWE-94] in Icinga 2, an open-source monitoring system. The /v1/objects API writes attacker-controlled template names into generated configuration files without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 Domain Specific Language (DSL) configuration, escape the intended object boundaries, and create additional objects beyond their assigned privileges.

The flaw affects versions from 2.4 up to (but not including) 2.14.9, 2.15.4, and 2.16.2. Fixes are shipped in Icinga 2 releases v2.14.9, v2.15.4, and v2.16.2.

Critical Impact
An authenticated low-to-mid privileged API user can escalate privileges by injecting arbitrary Icinga 2 DSL, creating monitoring objects and configuration outside their authorized scope.

Affected Products

Icinga 2 versions 2.4 through 2.14.8
Icinga 2 versions 2.15.0 through 2.15.3
Icinga 2 versions 2.16.0 through 2.16.1

Discovery Timeline

2026-09-18 - CVE-2026-61552 published to the National Vulnerability Database
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-61552

Vulnerability Analysis

Icinga 2 exposes a REST API at /v1/objects that allows authenticated users with objects/create/* permission to create configuration objects such as hosts, services, and templates. When the API persists these objects, it serializes them to on-disk configuration using the internal ConfigWriter component.

The ConfigWriter::EmitScope routine emitted import statements by concatenating a raw double-quoted string with the caller-supplied template name. Because the template name was not escaped, an attacker could embed a closing quote and additional DSL statements inside the value. The injected DSL is then parsed and executed by Icinga 2 as trusted configuration, allowing the attacker to define additional objects or apply attributes that exceed the permission scope granted to the calling ApiUser.

Root Cause

The root cause is missing output encoding when writing user-controlled data into a code context. In lib/base/configwriter.cpp, imports were written with fp << "import \"" << import << "\"", which trusts the input to be a bare identifier. A template name containing " or newline characters breaks out of the string literal and injects new DSL directives.

Attack Vector

The attack requires network access to the Icinga 2 API and valid ApiUser credentials holding an objects/create/* permission. The attacker submits a create request through /v1/objects where the imports array contains a crafted template name embedding DSL syntax. When Icinga 2 writes the object to disk and reloads configuration, the injected DSL executes with full configuration authority.

cpp

// Patch: lib/base/configwriter.cpp - ConfigWriter::EmitScope
// Before: raw concatenation of the import name inside quotes
// After: use EmitString to safely escape the value

		for (const Value& import : imports) {
			fp << "\n";
			EmitIndent(fp, indentLevel);
-			fp << "import \"" << import << "\"";
+			fp << "import ";
+			EmitString(fp, import.Get<String>());
		}

		fp << "\n";

Source: Icinga2 Commit 125b7734

Detection Methods for CVE-2026-61552

Indicators of Compromise

Icinga 2 configuration files containing unexpected import statements, stray double quotes, or newlines embedded within template names.
API audit records showing POST or PUT requests to /v1/objects/* with imports array values containing ", \n, {, or } characters.
New configuration objects owned by an ApiUser whose permissions should not allow their creation.
Icinga 2 reload or validation errors correlated with recent API create operations from a specific ApiUser.

Detection Strategies

Parse Icinga 2 API access logs and alert on requests to /v1/objects/* whose JSON body contains suspicious characters inside imports or templates fields.
Compare the set of on-disk configuration objects against the permission grants defined in api-users.conf to identify objects created outside a user's scope.
Monitor for unexpected changes to files under the Icinga 2 API packages directory, typically /var/lib/icinga2/api/packages/_api/.

Monitoring Recommendations

Forward Icinga 2 API access and audit logs to a centralized logging platform for retention and analytics.
Enable Icinga 2 debug-level logging on the API endpoint temporarily during triage to capture full request bodies.
Track version and package inventory to confirm hosts are running v2.14.9, v2.15.4, v2.16.2, or later.

How to Mitigate CVE-2026-61552

Immediate Actions Required

Upgrade Icinga 2 to v2.14.9, v2.15.4, or v2.16.2 depending on your current release branch.
Review all ApiUser definitions and remove or narrow objects/create/* permissions that are not strictly required.
Audit the on-disk configuration under the API packages directory for objects created via /v1/objects since the deployment of any affected version.
Rotate credentials for ApiUser accounts that had create permissions if compromise is suspected.

Patch Information

The vendor released fixes in Icinga 2 v2.14.9, v2.15.4, and v2.16.2. Technical details are documented in the GHSA-jgqj-x5j9-vgcm security advisory and the Icinga 2.16.2 security release blog post. The core code change routes import names through EmitString, which correctly escapes quotes and control characters.

Workarounds

Restrict network access to the Icinga 2 API to trusted management hosts using firewall rules or a reverse proxy access list.
Remove objects/create/* permissions from any ApiUser that does not require object creation until patching is complete.
Disable automation or integrations that submit third-party controlled template names to /v1/objects until upgraded.

bash

# Example: constrain an ApiUser to read-only access as a temporary workaround
# /etc/icinga2/conf.d/api-users.conf
object ApiUser "readonly-automation" {
  password = "REPLACE_WITH_STRONG_SECRET"
  permissions = [ "objects/query/*", "status/query" ]
}

# Verify configuration and reload after changes
icinga2 daemon -C && systemctl reload icinga2