Executive brief
Icinga 2 is an open-source monitoring system used to track infrastructure health across networks. An unauthenticated attacker able to reach the monitoring cluster on port 5665 can send a crafted message to replace certificates and impersonate trusted nodes, gaining complete control over monitored systems without valid credentials.
Technical details
The UpdateCertificateHandler in the JSON-RPC message processor fails to validate that the message sender is a trusted endpoint before accepting certificate update requests. An unauthenticated network attacker can send a certificate replacement message to TCP port 5665 to overwrite node certificates and trusted CA certificates, enabling node impersonation and cluster takeover. The fix adds validation to ensure the sender's client has a valid endpoint identity before processing certificate updates.
Affected products
- Icinga Icinga 2 2.8 to 2.14.8, 2.15.0 to 2.15.3, 2.16.0 to 2.16.1
Timeline
- 2026-09-18: disclosed
- 2026-09-18: patched: Fixed in versions 2.14.9, 2.15.4, and 2.16.2