Icinga 2 Patches CVSS 9.8 Auth Bypass and Stack Overflow

The Icinga project shipped fixes for two security flaws on September 18, 2026. One is critical. If you run Icinga 2, upgrade now.

CVE-2026-61550 (CVSS 9.8, critical): Icinga 2’s JSON-RPC message handling for certificate updates does not verify the sender is a trusted cluster endpoint. An unauthenticated, remote attacker can send crafted certificate update messages that cause Icinga 2 to accept a malicious node as a trusted cluster member. Affected versions run from 2.8 through 2.14.8, 2.15.3, and 2.16.1. Source: NVD.

CVE-2026-61551 (CVSS 8.6, high): Icinga 2’s JSON parser places no bound on recursion depth. A deeply nested JSON payload can exhaust the call stack and crash the Icinga 2 process. Affected versions run prior to 2.14.9, 2.15.4, and 2.16.2. Source: NVD.

The fixes

Both CVEs are resolved in Icinga 2 versions 2.14.9, 2.15.4, and 2.16.2. Pick the release that matches your branch and upgrade.

No workaround is documented for CVE-2026-61550. That one requires patching. For the stack overflow, rate-limiting inbound connections reduces exposure but doesn’t close the parser gap. Patch both.

What to do

Upgrade to 2.14.9, 2.15.4, or 2.16.2 based on your branch. Release notes are in the Icinga 2 changelog.

After patching, audit your cluster’s trusted node list. CVE-2026-61550 allows an unauthenticated attacker to insert a node into your cluster. If your instance was exposed before the patch, verify no unexpected nodes appear in your cluster configuration.

Icinga 2 typically runs with credentials to managed hosts and broad visibility into the environments it monitors. A node injected via CVE-2026-61550 inherits whatever trust the cluster grants to its members. Restrict network access to the Icinga 2 API and cluster ports to known, trusted hosts while you schedule the upgrade if you can’t patch immediately.

Related: MISP CLI auth bypass CVE-2026-90895 and ScreenConnect worm attacks via CVE-2026-84869.