Icinga icinga-powershell-framework up to 1.11.1/1.12.3/1.13.3 on Windows default permission

Summaryinfo

A vulnerability was found in Icinga icinga-powershell-framework up to 1.11.1/1.12.3/1.13.3 on Windows. It has been rated as critical. This affects an unknown part. Performing a manipulation results in default permission. This vulnerability is known as CVE-2026-24414. Attacking locally is a requirement. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Icinga icinga-powershell-framework up to 1.11.1/1.12.3/1.13.3 on Windows. It has been classified as problematic. This affects an unknown function. The manipulation with an unknown input leads to a default permission vulnerability. CWE is classifying the issue as CWE-276. During installation, installed file permissions are set to allow anyone to modify those files. This is going to have an impact on confidentiality. The summary by CVE is:

The Icinga PowerShell Framework provides configuration and check possibilities to ensure integration and monitoring of Windows environments. In versions prior to 1.13.4, 1.12.4, and 1.11.2, permissions of the Icinga for Windows `certificate` directory grant every user read access, which results in the exposure of private key of the Icinga certificate for the given host. All installations are affected. Versions 1.13.4, 1.12.4, and 1.11.2 contains a patch. Please note that upgrading to a fixed version of Icinga for Windows will also automatically fix a similar issue present in Icinga 2, CVE-2026-24413. As a workaround, the permissions can be restricted manually by updating the ACL for the given folder `C:\Program Files\WindowsPowerShell\modules\icinga-powershell-framework\certificate` (and `C:\ProgramData\icinga2\var` to fix the issue for the Icinga 2 agent as well) including every sub-folder and item to restrict access for general users, only allowing the Icinga service user and administrators access.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-24414 since 01/22/2026. The exploitability is told to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1222 according to MITRE ATT&CK.

Upgrading to version 1.11.2, 1.12.4 or 1.13.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-4963). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Icinga

Name

• icinga-powershell-framework

Version

• 1.11.0
• 1.11.1
• 1.12.0
• 1.12.1
• 1.12.2
• 1.12.3
• 1.13.0
• 1.13.1
• 1.13.2
• 1.13.3

Website

• Product: https://github.com/Icinga/icinga-powershell-framework/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion