CVE-2026-61550

Name of the Vulnerable Software and Affected Versions Icinga 2 versions 2.8 through 2.14.8 Icinga 2 versions 2.15.0 through 2.15.3 Icinga 2 versions 2.16.0 through 2.16.1

Description Certificate update JSON-RPC message handling fails to validate whether the sender is a trusted endpoint. An unauthenticated network attacker with access to TCP port 5665 can replace the node certificate and trusted CA certificate, allowing them to impersonate a trusted node and gain control of the system.

Recommendations Update to version 2.14.9 Update to version 2.15.4 Update to version 2.16.2