CVE catalog

CVE-2021-32743

icinga2 affected and fixed versions

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions prior to 2.11.10 and from version 2.12.0 through version 2.12.4, some of the Icinga 2 features that require credentials for external services expose those credentials through the API to authenticated API users with read permissions for the corresponding object types. IdoMysqlConnection and IdoPgsqlConnection (every released version) exposes the password of the user used to connect to the database. IcingaDB (added in 2.12.0) exposes the password used to connect to the Redis server. ElasticsearchWriter (added in 2.8.0)exposes the password used to connect to the Elasticsearch server. An attacker who obtains these credentials can impersonate Icinga to these services and add, modify and delete information there. If credentials with more permissions are in use, this increases the impact accordingly. Starting with the 2.11.10 and 2.12.5 releases, these passwords are no longer exposed via the API. As a workaround, API user permissions can be restricted to not allow querying of any affected objects, either by explicitly listing only the required object types for object query permissions, or by applying a filter rule.

Severity: High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: Jul 15, 2021, 4:15:09 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.80% · Oct 27, 2026

Projects and upstream resources

[icinga2][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie-security	icinga2	`2.14.6-1+deb13u1`	Fixed	[CVE-2021-32743]
Debiantrixie	icinga2	`2.12.5-1`	FixedDistribution-reported fixed boundary	[CVE-2021-32743]
Debiantrixie	icinga2	`2.14.6-1`	Fixed	[CVE-2021-32743]
Debiansid	icinga2	`2.12.5-1`	FixedDistribution-reported fixed boundary	[CVE-2021-32743]
Debiansid	icinga2	`2.16.6-1`	Fixed	[CVE-2021-32743]
Debianforky	icinga2	`2.12.5-1`	FixedDistribution-reported fixed boundary	[CVE-2021-32743]
Debianforky	icinga2	`2.16.5-1`	Fixed	[CVE-2021-32743]
Debianbookworm	icinga2	`2.12.5-1`	FixedDistribution-reported fixed boundary	[CVE-2021-32743]
Debianbookworm	icinga2	`2.13.6-2+deb12u2`	Fixed	[CVE-2021-32743]

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	icinga2	`2.12.5-1`	FixedDistribution-reported fixed boundary	[CVE-2021-32743]
Debianbookworm	icinga2	`2.13.6-2+deb12u2`	Fixed	[CVE-2021-32743]
Debianforky	icinga2	`2.12.5-1`	FixedDistribution-reported fixed boundary	[CVE-2021-32743]
Debianforky	icinga2	`2.16.5-1`	Fixed	[CVE-2021-32743]
Debiansid	icinga2	`2.12.5-1`	FixedDistribution-reported fixed boundary	[CVE-2021-32743]
Debiansid	icinga2	`2.16.6-1`	Fixed	[CVE-2021-32743]
Debiantrixie	icinga2	`2.12.5-1`	FixedDistribution-reported fixed boundary	[CVE-2021-32743]
Debiantrixie	icinga2	`2.14.6-1`	Fixed	[CVE-2021-32743]
Debiantrixie-security	icinga2	`2.14.6-1+deb13u1`	Fixed	[CVE-2021-32743]

Original provider fields

{
  "package_releases": [
    {
      "name": "icinga2",
      "status": "fixed",
      "release": "sid",
      "version": "2.16.6-1"
    },
    {
      "name": "icinga2",
      "status": "fixed",
      "release": "forky",
      "version": "2.16.5-1"
    },
    {
      "name": "icinga2",
      "status": "fixed",
      "release": "trixie",
      "version": "2.14.6-1"
    },
    {
      "name": "icinga2",
      "status": "fixed",
      "release": "trixie-security",
      "version": "2.14.6-1+deb13u1"
    },
    {
      "name": "icinga2",
      "status": "fixed",
      "release": "bookworm",
      "version": "2.13.6-2+deb12u2"
    }
  ],
  "fixed_versions": [
    {
      "bug": 991494,
      "name": "icinga2",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "2.12.5-1"
    },
    {
      "bug": 991494,
      "name": "icinga2",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "2.12.5-1"
    },
    {
      "bug": 991494,
      "name": "icinga2",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "2.12.5-1"
    },
    {
      "bug": 991494,
      "name": "icinga2",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "2.12.5-1"
    }
  ],
  "distribution_packages": []
}

[Debian bug #991494]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[icinga2]Unknown
Details (2)
- 2.13.6-2+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12
- 2.13.6-2+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12
[icinga2-bin]Unknown
Source package: [icinga2]
Details (2)
- 2.13.6-2+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12
- 2.13.6-2+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12
[icinga2-common]Unknown
Source package: [icinga2]
Details (2)
- 2.13.6-2+deb12u2 · all · bookworm
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12
- 2.13.6-2+deb12u2 · all · bookworm
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12
[icinga2-doc]Unknown
Source package: [icinga2]
Details (2)
- 2.13.6-2+deb12u2 · all · bookworm
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12
- 2.13.6-2+deb12u2 · all · bookworm
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12
[icinga2-ido-mysql]Unknown
Source package: [icinga2]
Details (2)
- 2.13.6-2+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12
- 2.13.6-2+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12
[icinga2-ido-pgsql]Unknown
Source package: [icinga2]
Details (2)
- 2.13.6-2+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12
- 2.13.6-2+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12
[vim-icinga2]Unknown
Source package: [icinga2]
Details (2)
- 2.13.6-2+deb12u2 · all · bookworm
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12
- 2.13.6-2+deb12u2 · all · bookworm
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · bookworm; dsa · icinga2 · debian · 12

[Debian 13 (Trixie)]

[icinga2]Unknown
Details (4)
- 2.14.6-1 · amd64 · trixie
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1 · arm64 · trixie
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
[icinga2-bin]Unknown
Source package: [icinga2]
Details (4)
- 2.14.6-1 · amd64 · trixie
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1 · arm64 · trixie
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
[icinga2-common]Unknown
Source package: [icinga2]
Details (4)
- 2.14.6-1 · all · trixie
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1 · all · trixie
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1+deb13u1 · all · trixie-security
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1+deb13u1 · all · trixie-security
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
[icinga2-doc]Unknown
Source package: [icinga2]
Details (4)
- 2.14.6-1 · all · trixie
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1 · all · trixie
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1+deb13u1 · all · trixie-security
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1+deb13u1 · all · trixie-security
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
[icinga2-ido-mysql]Unknown
Source package: [icinga2]
Details (4)
- 2.14.6-1 · amd64 · trixie
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1 · arm64 · trixie
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
[icinga2-ido-pgsql]Unknown
Source package: [icinga2]
Details (4)
- 2.14.6-1 · amd64 · trixie
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1 · arm64 · trixie
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
[vim-icinga2]Unknown
Source package: [icinga2]
Details (4)
- 2.14.6-1 · all · trixie
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1 · all · trixie
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1+deb13u1 · all · trixie-security
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13
- 2.14.6-1+deb13u1 · all · trixie-security
  Fixed · Fixed: 2.12.5-1
  dsa · icinga2 · debian · 13

Observed: Oct 23, 2026, 5:57:35 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]