CVE-2026-61552: 
Icinga vulnerability analysis and mitigation

CVE-2026-61552 is a DSL injection vulnerability in Icinga 2 caused by unescaped import template names when creating configuration objects via the /v1/objects API endpoint. Affected versions span from 2.4 up to (but not including) 2.16.2, with patched versions available at 2.16.2, 2.15.4, and 2.14.9. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) (Icinga Advisory). It was published on June 29, 2026, and was independently reported by multiple researchers (Icinga Advisory).

The root cause is insufficient input sanitization (improper neutralization of special elements) when template names supplied via the /v1/objects API endpoint are written directly into Icinga 2 configuration files. An authenticated API user with any objects/create/* permission can inject arbitrary Icinga 2 DSL (Domain Specific Language) configuration by crafting malicious template names, enabling privilege escalation within the monitoring environment. The attack vector is network-based, requires high privileges (a valid API user with object creation rights), and no user interaction (Icinga Advisory).

Successful exploitation allows an authenticated API user to inject arbitrary Icinga 2 configuration, leading to full compromise of confidentiality, integrity, and availability of the affected Icinga 2 instance. The attacker can escalate their privileges within the monitoring system, potentially gaining control over monitored hosts, check commands, and notification configurations. This could facilitate lateral movement within the monitored infrastructure by manipulating check scripts or notification handlers (Icinga Advisory).

Exploitation requires a valid Icinga 2 API user account with at least one objects/create/* permission, limiting the attack surface to authenticated users. No public proof-of-concept exploit code has been identified in the available sources, and there is no current evidence of in-the-wild exploitation. The vulnerability is detectable by Nessus (plugin 333603) and Qualys (detection ID 6285557) (Tenable). CISA KEV catalog status and EPSS score are not currently available for this CVE.

1. Reconnaissance: Identify Icinga 2 instances running versions >=2.4 and <2.16.2 (or <2.15.4 / <2.14.9 for older branches) that expose the REST API, typically on port 5665.
2. Obtain API credentials: Acquire or compromise an Icinga 2 API user account that holds any objects/create/* permission (e.g., objects/create/Service).
3. Craft malicious request: Send an HTTP POST request to the /v1/objects/<type>/<name> endpoint, embedding a crafted template name containing Icinga 2 DSL syntax (e.g., newlines and additional configuration directives) in the templates array of the JSON body.
4. Trigger config write: Icinga 2 writes the unsanitized template name directly into a generated configuration file on disk without escaping special characters.
5. Achieve privilege escalation: The injected DSL configuration is parsed and applied by Icinga 2, granting the attacker elevated permissions or the ability to execute arbitrary commands via check or event handler definitions (Icinga Advisory).

• Network: Unusual or unexpected POST requests to /v1/objects/ API endpoints from API users not typically performing object creation; API calls with abnormally long or specially formatted templates values.
• File System: Icinga 2 configuration files (typically under /etc/icinga2/ or the zones.d directory) containing unexpected DSL directives, newline characters, or configuration blocks not matching normal administrative activity; newly created or modified .conf files with unusual content.
• Logs: Icinga 2 API access logs showing object creation requests with suspicious template names; Icinga 2 daemon logs indicating unexpected configuration reloads or newly applied permissions.
• Process: Unexpected child processes spawned by the Icinga 2 daemon (e.g., shell commands) that correspond to injected event handler or check command definitions (Icinga Advisory).

Icinga has released patched versions 2.16.2, 2.15.4, and 2.14.9, which include fixes for this vulnerability; upgrading to one of these versions is the recommended remediation (Icinga Advisory). As an immediate workaround, administrators should remove objects/create/* permissions from all API users that do not strictly require them, as the vulnerability is only exploitable by users holding these permissions. Additionally, restricting API access to trusted IP ranges via firewall rules reduces the attack surface.

The vulnerability was covered by security aggregators including AusCERT (ESB-2026.9286) and Pro-Linux, and was picked up by Linux compatibility news outlets noting it as part of a broader Debian security update batch (AusCERT). The Icinga project acknowledged independent discovery by researchers TristanInSec and de3erve-hunter alongside their own internal identification, suggesting active community engagement with the issue (Icinga Advisory).