{"id":"CVE-2026-61552","state":"PUBLISHED","title":"Icinga 2 DSL Injection via Unescaped Import Template Name","description":"Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, escape the intended object, create additional objects, and exceed the user's assigned privileges. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.","publishedAt":"2026-09-18T17:24:42.394Z","updatedAt":"2026-09-18T18:05:44.787Z","severity":{"score":7.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["Icinga icinga2"],"affected":[{"vendor":"Icinga","product":"icinga2","versions":[{"version":">= 2.4, < 2.14.9","status":"affected"},{"version":">= 2.15.0, < 2.15.4","status":"affected"},{"version":">= 2.16.0, < 2.16.2","status":"affected"}]}],"references":["https://github.com/Icinga/icinga2/security/advisories/GHSA-jgqj-x5j9-vgcm","https://github.com/Icinga/icinga2/pull/10910","https://github.com/Icinga/icinga2/commit/125b7734e84d03f09b79d36c270152b11629a8c5","https://github.com/Icinga/icinga2/commit/af4b36e6464b9b214bed270a53d6474cf91eb441","https://github.com/Icinga/icinga2/commit/eec0d90e8303376fe772b3e4a04e3b064a44cf30","https://github.com/Icinga/icinga2/commit/faf0450962ad678397991cfdf041810feafa71e7","https://github.com/Icinga/icinga2/releases/tag/v2.14.9","https://github.com/Icinga/icinga2/releases/tag/v2.15.4","https://github.com/Icinga/icinga2/releases/tag/v2.16.2","https://icinga.com/blog/icinga2-security-release-v2-16-2"],"weaknesses":["CWE-94"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/61xxx/CVE-2026-61552.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-61552","state":"PUBLISHED","datePublished":"2026-09-18T17:24:42.394Z","dateUpdated":"2026-09-18T18:05:44.787Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-07-10T16:48:39.922Z"},"containers":{"cna":{"title":"Icinga 2 DSL Injection via Unescaped Import Template Name","descriptions":[{"lang":"en","value":"Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, escape the intended object, create additional objects, and exceed the user's assigned privileges. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2."}],"affected":[{"vendor":"Icinga","product":"icinga2","versions":[{"version":">= 2.4, < 2.14.9","status":"affected"},{"version":">= 2.15.0, < 2.15.4","status":"affected"},{"version":">= 2.16.0, < 2.16.2","status":"affected"}]}],"references":[{"url":"https://github.com/Icinga/icinga2/security/advisories/GHSA-jgqj-x5j9-vgcm","name":"https://github.com/Icinga/icinga2/security/advisories/GHSA-jgqj-x5j9-vgcm","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/Icinga/icinga2/pull/10910","name":"https://github.com/Icinga/icinga2/pull/10910","tags":["x_refsource_MISC"]},{"url":"https://github.com/Icinga/icinga2/commit/125b7734e84d03f09b79d36c270152b11629a8c5","name":"https://github.com/Icinga/icinga2/commit/125b7734e84d03f09b79d36c270152b11629a8c5","tags":["x_refsource_MISC"]},{"url":"https://github.com/Icinga/icinga2/commit/af4b36e6464b9b214bed270a53d6474cf91eb441","name":"https://github.com/Icinga/icinga2/commit/af4b36e6464b9b214bed270a53d6474cf91eb441","tags":["x_refsource_MISC"]},{"url":"https://github.com/Icinga/icinga2/commit/eec0d90e8303376fe772b3e4a04e3b064a44cf30","name":"https://github.com/Icinga/icinga2/commit/eec0d90e8303376fe772b3e4a04e3b064a44cf30","tags":["x_refsource_MISC"]},{"url":"https://github.com/Icinga/icinga2/commit/faf0450962ad678397991cfdf041810feafa71e7","name":"https://github.com/Icinga/icinga2/commit/faf0450962ad678397991cfdf041810feafa71e7","tags":["x_refsource_MISC"]},{"url":"https://github.com/Icinga/icinga2/releases/tag/v2.14.9","name":"https://github.com/Icinga/icinga2/releases/tag/v2.14.9","tags":["x_refsource_MISC"]},{"url":"https://github.com/Icinga/icinga2/releases/tag/v2.15.4","name":"https://github.com/Icinga/icinga2/releases/tag/v2.15.4","tags":["x_refsource_MISC"]},{"url":"https://github.com/Icinga/icinga2/releases/tag/v2.16.2","name":"https://github.com/Icinga/icinga2/releases/tag/v2.16.2","tags":["x_refsource_MISC"]},{"url":"https://icinga.com/blog/icinga2-security-release-v2-16-2","name":"https://icinga.com/blog/icinga2-security-release-v2-16-2","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-94","lang":"en","description":"CWE-94: Improper Control of Generation of Code ('Code Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-09-18T17:24:42.394Z"},"source":{"advisory":"GHSA-jgqj-x5j9-vgcm","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-18T18:05:25.228828Z","id":"CVE-2026-61552","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-18T18:05:44.787Z"}}]}}}