Icinga 2 JSON-RPC endpoint skips sender validation, allows node injection
Unauthenticated attacker can inject a malicious node into an Icinga 2 cluster by spoofing certificate update JSON-RPC messages. CVSS 9.8 critical. Fixed in 2.14.9, 2.15.4, 2.16.2.
- Vendor
- Icinga
- Product
- Icinga 2
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.7%
- Status
- patched
- Published
Is CVE-2026-61550 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-61550 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-05 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.7% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-61550 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Icinga 2’s JSON-RPC message handling for certificate updates does not verify that the sender is a trusted cluster endpoint. From version 2.8 through 2.14.8, 2.15.3, and 2.16.1, an unauthenticated remote attacker can send crafted certificate update messages to force Icinga 2 to accept a malicious node as trusted, compromising cluster integrity.
Fixed in Icinga 2.14.9, 2.15.4, and 2.16.2. No workaround is documented. Upgrade immediately; this is an unauthenticated cluster takeover path.
See NVD and the Icinga 2 GitHub advisory for version details.
Other Icinga CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-61551 Icinga 2 unbounded JSON nesting causes stack exhaustionwrite-up | [ HIGH ] | 8.6 | 0.9% | — |
