CVE catalog

CVE-2026-24413

icinga2: CVE-2026-24413

Severity: Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published: Jan 29, 2026, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.08% · Oct 25, 2026

Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set appropriate permissions for the `%ProgramData%\icinga2\var` folder on Windows. This resulted in the its contents - including the private key of the user and synced configuration - being readable by all local users. All installations on Windows are affected. Versions 2.13.14, 2.14.8, and 2.15.2 contains a fix. There are two possibilities to work around the issue without upgrading Icinga 2. Upgrade Icinga for Windows to at least version v1.13.4, v1.12.4, or v1.11.2. These version will automatically fix the ACLs for the Icinga 2 agent as well. Alternatively, manually update the ACL for the given folder `C:\ProgramData\icinga2\var` (and `C:\Program Files\WindowsPowerShell\modules\icinga-powershell-framework\certificate` to fix the issue for the Icinga for Windows as well) including every sub-folder and item to restrict access for general users, only allowing the Icinga service user and administrators access.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	icinga2	sid	`2.16.5-1`	not affected
Debian	icinga2	forky	`2.16.5-1`	not affected
Debian	icinga2	trixie	`2.14.6-1`	not affected
Debian	icinga2	trixie-security	`2.14.6-1+deb13u1`	not affected
Debian	icinga2	bookworm	`2.13.6-2+deb12u2`	not affected
Opensuse	icinga2	tumbleweed	`2.15.2-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	icinga2	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	icinga2	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	icinga2	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	icinga2	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Opensuse	icinga2	rpm	tumbleweed	`2.15.2-1.1`	Not reported	OPENSUSE-SU-2026:10113-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[icinga2-bin]Unknown
Source package: [icinga2]
Details (1)
- 2.16.5-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 2.15.2-1.1
  Version impact unknown
  dsa · icinga2 · opensuse · tumbleweed
[icinga2-common]Unknown
Source package: [icinga2]
Details (1)
- 2.16.5-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 2.15.2-1.1
  Version impact unknown
  dsa · icinga2 · opensuse · tumbleweed
[icinga2-doc]Unknown
Source package: [icinga2]
Details (1)
- 2.16.5-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 2.15.2-1.1
  Version impact unknown
  dsa · icinga2 · opensuse · tumbleweed
[icinga2-ido-mysql]Unknown
Source package: [icinga2]
Details (1)
- 2.16.5-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 2.15.2-1.1
  Version impact unknown
  dsa · icinga2 · opensuse · tumbleweed
[icinga2-ido-pgsql]Unknown
Source package: [icinga2]
Details (1)
- 2.16.5-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 2.15.2-1.1
  Version impact unknown
  dsa · icinga2 · opensuse · tumbleweed
[nano-icinga2]Unknown
Source package: [icinga2]
Details (1)
- 2.16.5-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 2.15.2-1.1
  Version impact unknown
  dsa · icinga2 · opensuse · tumbleweed
[vim-icinga2]Unknown
Source package: [icinga2]
Details (1)
- 2.16.5-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 2.15.2-1.1
  Version impact unknown
  dsa · icinga2 · opensuse · tumbleweed
[icinga2]Fixed
Source package: [icinga2]
Details (1)
- 2.16.5-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 2.15.2-1.1
  dsa · icinga2 · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[icinga2]Not affected
Details (2)
- 2.13.6-2+deb12u2 · amd64 · bookworm
  Not affected
  dsa · icinga2 · debian · bookworm
- 2.13.6-2+deb12u2 · arm64 · bookworm
  Not affected
  dsa · icinga2 · debian · bookworm
[icinga2-bin]Not affected
Source package: [icinga2]
Details (2)
- 2.13.6-2+deb12u2 · amd64 · bookworm
  Not affected
  dsa · icinga2 · debian · bookworm
- 2.13.6-2+deb12u2 · arm64 · bookworm
  Not affected
  dsa · icinga2 · debian · bookworm
[icinga2-common]Not affected
Source package: [icinga2]
Details (2)
- 2.13.6-2+deb12u2 · all · bookworm
  Not affected
  dsa · icinga2 · debian · bookworm
- 2.13.6-2+deb12u2 · all · bookworm
  Not affected
  dsa · icinga2 · debian · bookworm
[icinga2-doc]Not affected
Source package: [icinga2]
Details (2)
- 2.13.6-2+deb12u2 · all · bookworm
  Not affected
  dsa · icinga2 · debian · bookworm
- 2.13.6-2+deb12u2 · all · bookworm
  Not affected
  dsa · icinga2 · debian · bookworm
[icinga2-ido-mysql]Not affected
Source package: [icinga2]
Details (2)
- 2.13.6-2+deb12u2 · amd64 · bookworm
  Not affected
  dsa · icinga2 · debian · bookworm
- 2.13.6-2+deb12u2 · arm64 · bookworm
  Not affected
  dsa · icinga2 · debian · bookworm
[icinga2-ido-pgsql]Not affected
Source package: [icinga2]
Details (2)
- 2.13.6-2+deb12u2 · amd64 · bookworm
  Not affected
  dsa · icinga2 · debian · bookworm
- 2.13.6-2+deb12u2 · arm64 · bookworm
  Not affected
  dsa · icinga2 · debian · bookworm
[vim-icinga2]Not affected
Source package: [icinga2]
Details (2)
- 2.13.6-2+deb12u2 · all · bookworm
  Not affected
  dsa · icinga2 · debian · bookworm
- 2.13.6-2+deb12u2 · all · bookworm
  Not affected
  dsa · icinga2 · debian · bookworm

Observed: Oct 27, 2026, 9:57:14 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]