Icinga icinga2 up to 2.13.13/2.14.7/2.15.1 on Windows Service default permission

Summaryinfo

A vulnerability described as critical has been identified in Icinga icinga2 up to 2.13.13/2.14.7/2.15.1 on Windows. The impacted element is an unknown function of the component Service. Such manipulation leads to default permission. This vulnerability is referenced as CVE-2026-24413. The attack can only be performed from a local environment. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Icinga icinga2 up to 2.13.13/2.14.7/2.15.1 on Windows. Affected by this issue is an unknown code block of the component Service. The manipulation with an unknown input leads to a default permission vulnerability. Using CWE to declare the problem leads to CWE-276. During installation, installed file permissions are set to allow anyone to modify those files. Impacted is confidentiality. CVE summarizes:

Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set appropriate permissions for the `%ProgramData%\icinga2\var` folder on Windows. This resulted in the its contents - including the private key of the user and synced configuration - being readable by all local users. All installations on Windows are affected. Versions 2.13.14, 2.14.8, and 2.15.2 contains a fix. There are two possibilities to work around the issue without upgrading Icinga 2. Upgrade Icinga for Windows to at least version v1.13.4, v1.12.4, or v1.11.2. These version will automatically fix the ACLs for the Icinga 2 agent as well. Alternatively, manually update the ACL for the given folder `C:\ProgramData\icinga2\var` (and `C:\Program Files\WindowsPowerShell\modules\icinga-powershell-framework\certificate` to fix the issue for the Icinga for Windows as well) including every sub-folder and item to restrict access for general users, only allowing the Icinga service user and administrators access.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-24413 since 01/22/2026. The exploitation is known to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1222.

The vulnerability scanner Nessus provides a plugin with the ID 297400 (Linux Distros Unpatched Vulnerability : CVE-2026-24413), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.13.14, 2.14.8 or 2.15.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (297400), EUVD (EUVD-2026-4959) and CERT Bund (WID-SEC-2026-0260). Once again VulDB remains the best source for vulnerability data.

Affected

• SUSE openSUSE
• Open Source Icinga

Productinfo

Vendor

• Icinga

Name

• icinga2

Version

• 2.13.0
• 2.13.1
• 2.13.2
• 2.13.3
• 2.13.4
• 2.13.5
• 2.13.6
• 2.13.7
• 2.13.8
• 2.13.9
• 2.13.10
• 2.13.11
• 2.13.12
• 2.13.13
• 2.14.0
• 2.14.1
• 2.14.2
• 2.14.3
• 2.14.4
• 2.14.5
• 2.14.6
• 2.14.7
• 2.15.0
• 2.15.1

Website

• Product: https://github.com/Icinga/icinga2/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion