Executive brief
Icinga 2 is an open source monitoring system that tracks infrastructure health and alerts administrators to problems. An authenticated API user with limited permissions can inject malicious configuration commands by providing specially crafted template names to the /v1/objects API. This allows them to create unauthorized monitoring objects and exceed their assigned administrative privileges, potentially gaining full control over the monitoring system's configuration.
Technical details
The /v1/objects API endpoint fails to escape user-supplied template names when generating Icinga 2 DSL configuration, allowing an attacker to inject quotes and arbitrary DSL code. An authenticated ApiUser with objects/create/* permissions can exploit this to break out of the intended template context, create additional objects, and escalate their privileges. The vulnerability affects versions 2.4 through 2.14.8, 2.15.0 through 2.15.3, and 2.16.0 through 2.16.1, and is resolved by properly escaping template imports in the ConfigWriter::EmitScope method.
Affected products
- Icinga Icinga 2 2.4 to 2.14.8, 2.15.0 to 2.15.3, 2.16.0 to 2.16.1
Timeline
- 2026-09-18: disclosed
- 2026-09-18: patched: Fixed in versions 2.14.9, 2.15.4, and 2.16.2