CVE-2026-24413

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24413", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-22T18:19:49.174Z", "datePublished": "2026-01-29T17:21:01.438Z", "dateUpdated": "2026-01-29T21:23:20.671Z"}, "containers": {"cna": {"title": "Icinga has insecure permission of %ProgramData%\\icinga2\\var on Windows", "problemTypes": [{"descriptions": [{"cweId": "CWE-276", "lang": "en", "description": "CWE-276: Incorrect Default Permissions", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/Icinga/icinga2/security/advisories/GHSA-vfjg-6fpv-4mmr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Icinga/icinga2/security/advisories/GHSA-vfjg-6fpv-4mmr"}, {"name": "https://github.com/Icinga/icinga-powershell-framework/security/advisories/GHSA-88h5-rrm6-5973", "tags": ["x_refsource_MISC"], "url": "https://github.com/Icinga/icinga-powershell-framework/security/advisories/GHSA-88h5-rrm6-5973"}, {"name": "https://icinga.com/blog/releasing-icinga-2-v2-15-2-v2-14-8-v2-13-14-and-icinga-for-windows-v1-13-4-v1-12-4-v1-11-2", "tags": ["x_refsource_MISC"], "url": "https://icinga.com/blog/releasing-icinga-2-v2-15-2-v2-14-8-v2-13-14-and-icinga-for-windows-v1-13-4-v1-12-4-v1-11-2"}], "affected": [{"vendor": "Icinga", "product": "icinga2", "versions": [{"version": ">= 2.3.0, < 2.13.14", "status": "affected"}, {"version": ">= 2.14.0, < 2.14.8", "status": "affected"}, {"version": ">= 2.15.0, < 2.15.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-29T17:21:01.438Z"}, "descriptions": [{"lang": "en", "value": "Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set appropriate permissions for the `%ProgramData%\\icinga2\\var` folder on Windows. This resulted in the its contents - including the private key of the user and synced configuration - being readable by all local users. All installations on Windows are affected. Versions 2.13.14, 2.14.8, and 2.15.2 contains a fix. There are two possibilities to work around the issue without upgrading Icinga 2. Upgrade Icinga for Windows to at least version v1.13.4, v1.12.4, or v1.11.2. These version will automatically fix the ACLs for the Icinga 2 agent as well. Alternatively, manually update the ACL for the given folder `C:\\ProgramData\\icinga2\\var` (and `C:\\Program Files\\WindowsPowerShell\\modules\\icinga-powershell-framework\\certificate` to fix the issue for the Icinga for Windows as well) including every sub-folder and item to restrict access for general users, only allowing the Icinga service user and administrators access."}], "source": {"advisory": "GHSA-vfjg-6fpv-4mmr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-29T21:23:06.715208Z", "id": "CVE-2026-24413", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T21:23:20.671Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24413", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-29T21:23:06.715208Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T21:23:13.245Z"}}], "cna": {"title": "Icinga has insecure permission of %ProgramData%\\icinga2\\var on Windows", "source": {"advisory": "GHSA-vfjg-6fpv-4mmr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Icinga", "product": "icinga2", "versions": [{"status": "affected", "version": ">= 2.3.0, < 2.13.14"}, {"status": "affected", "version": ">= 2.14.0, < 2.14.8"}, {"status": "affected", "version": ">= 2.15.0, < 2.15.2"}]}], "references": [{"url": "https://github.com/Icinga/icinga2/security/advisories/GHSA-vfjg-6fpv-4mmr", "name": "https://github.com/Icinga/icinga2/security/advisories/GHSA-vfjg-6fpv-4mmr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Icinga/icinga-powershell-framework/security/advisories/GHSA-88h5-rrm6-5973", "name": "https://github.com/Icinga/icinga-powershell-framework/security/advisories/GHSA-88h5-rrm6-5973", "tags": ["x_refsource_MISC"]}, {"url": "https://icinga.com/blog/releasing-icinga-2-v2-15-2-v2-14-8-v2-13-14-and-icinga-for-windows-v1-13-4-v1-12-4-v1-11-2", "name": "https://icinga.com/blog/releasing-icinga-2-v2-15-2-v2-14-8-v2-13-14-and-icinga-for-windows-v1-13-4-v1-12-4-v1-11-2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set appropriate permissions for the `%ProgramData%\\icinga2\\var` folder on Windows. This resulted in the its contents - including the private key of the user and synced configuration - being readable by all local users. All installations on Windows are affected. Versions 2.13.14, 2.14.8, and 2.15.2 contains a fix. There are two possibilities to work around the issue without upgrading Icinga 2. Upgrade Icinga for Windows to at least version v1.13.4, v1.12.4, or v1.11.2. These version will automatically fix the ACLs for the Icinga 2 agent as well. Alternatively, manually update the ACL for the given folder `C:\\ProgramData\\icinga2\\var` (and `C:\\Program Files\\WindowsPowerShell\\modules\\icinga-powershell-framework\\certificate` to fix the issue for the Icinga for Windows as well) including every sub-folder and item to restrict access for general users, only allowing the Icinga service user and administrators access."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-276", "description": "CWE-276: Incorrect Default Permissions"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-29T17:21:01.438Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24413", "state": "PUBLISHED", "dateUpdated": "2026-01-29T21:23:20.671Z", "dateReserved": "2026-01-22T18:19:49.174Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-29T17:21:01.438Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "icinga2", "vendor": "Icinga", "versions": [{"status": "affected", "version": ">= 2.3.0, < 2.13.14"}, {"status": "affected", "version": ">= 2.14.0, < 2.14.8"}, {"status": "affected", "version": ">= 2.15.0, < 2.15.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*", "matchCriteriaId": "EF4A8D01-2AF4-42AB-BD24-FFFBA30B2BE9", "versionEndExcluding": "2.13.14", "versionStartIncluding": "2.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*", "matchCriteriaId": "EF121DB1-2B90-40BB-ACC2-A4E15D48DA80", "versionEndExcluding": "2.14.8", "versionStartIncluding": "2.14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*", "matchCriteriaId": "0C5F1C29-FC79-492C-A2A9-1DA4E65268F6", "versionEndExcluding": "2.15.2", "versionStartIncluding": "2.15.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set appropriate permissions for the `%ProgramData%\\icinga2\\var` folder on Windows. This resulted in the its contents - including the private key of the user and synced configuration - being readable by all local users. All installations on Windows are affected. Versions 2.13.14, 2.14.8, and 2.15.2 contains a fix. There are two possibilities to work around the issue without upgrading Icinga 2. Upgrade Icinga for Windows to at least version v1.13.4, v1.12.4, or v1.11.2. These version will automatically fix the ACLs for the Icinga 2 agent as well. Alternatively, manually update the ACL for the given folder `C:\\ProgramData\\icinga2\\var` (and `C:\\Program Files\\WindowsPowerShell\\modules\\icinga-powershell-framework\\certificate` to fix the issue for the Icinga for Windows as well) including every sub-folder and item to restrict access for general users, only allowing the Icinga service user and administrators access."}, {"lang": "es", "value": "Icinga 2 es un sistema de monitoreo de c\u00f3digo abierto. A partir de la versi\u00f3n 2.3.0 y antes de las versiones 2.13.14, 2.14.8 y 2.15.2, el MSI de Icinga 2 no configuraba los permisos adecuados para la carpeta '%ProgramData%\\icinga2\\var' en Windows. Esto resultaba en que su contenido - incluyendo la clave privada del usuario y la configuraci\u00f3n sincronizada - fuera legible por todos los usuarios locales. Todas las instalaciones en Windows est\u00e1n afectadas. Las versiones 2.13.14, 2.14.8 y 2.15.2 contienen una soluci\u00f3n. Existen dos posibilidades para solucionar el problema sin actualizar Icinga 2. Actualice Icinga para Windows a al menos la versi\u00f3n v1.13.4, v1.12.4 o v1.11.2. Estas versiones corregir\u00e1n autom\u00e1ticamente las ACL para el agente de Icinga 2 tambi\u00e9n. Alternativamente, actualice manualmente la ACL para la carpeta dada 'C:\\ProgramData\\icinga2\\var' (y 'C:\\Program Files\\WindowsPowerShell\\modules\\icinga-powershell-framework\\certificate' para solucionar el problema tambi\u00e9n para Icinga para Windows) incluyendo cada subcarpeta y elemento para restringir el acceso a los usuarios generales, permitiendo el acceso solo al usuario de servicio de Icinga y a los administradores."}], "id": "CVE-2026-24413", "lastModified": "2026-06-17T10:23:01.910", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24413", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-29T21:23:06.715208Z", "version": "2.0.3"}}]}, "published": "2026-01-29T18:16:15.450", "references": [{"source": "security-advisories@github.com", "tags": ["Not Applicable"], "url": "https://github.com/Icinga/icinga-powershell-framework/security/advisories/GHSA-88h5-rrm6-5973"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/Icinga/icinga2/security/advisories/GHSA-vfjg-6fpv-4mmr"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Press/Media Coverage"], "url": "https://icinga.com/blog/releasing-icinga-2-v2-15-2-v2-14-8-v2-13-14-and-icinga-for-windows-v1-13-4-v1-12-4-v1-11-2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T14:33:10.897785+00:00", "value": {"mitigation_remediation": ["Upgrade Icinga\u202f2 to at least version\u202f2.13.14,\u202f2.14.8, or\u202f2.15.2, which include the ACL fix.", "If using the Icinga for Windows service, upgrade to at least v1.13.4,\u202fv1.12.4, or\u202fv1.11.2 to apply the corrected permissions for the agent directory.", "If upgrading is not possible, manually adjust the ACL on C:\\\\ProgramData\\\\icinga2\\\\var and C:\\\\Program Files\\\\WindowsPowerShell\\\\modules\\\\icinga-powershell-framework\\\\certificate, limiting access to the Icinga service account and administrators and removing rights for other local users."], "summary": {"action": "Patch immediately", "impact": "Confidentiality breach via improper folder permissions"}, "threat_synthesis": {"affected_systems": "All Windows installations of Icinga\u202f2 running affected versions are vulnerable. Specifically, Icinga\u202f2 versions earlier than 2.13.14, 2.14.8, or 2.15.2 have the misconfigured ACLs, as do Icinga for Windows packages older than v1.13.4, v1.12.4, or v1.11.2. The issue also extends to the PowerShell framework certificate directory used by the Windows agent.", "description_and_impact": "The Icinga\u202f2 MSI installer for Windows sets incorrect ACLs on the %ProgramData%\\icinga2\\var folder in versions before 2.13.14, 2.14.8, and 2.15.2. This misconfiguration allows any local user to read the folder\u2019s contents, including the service\u2019s private key and synchronized configuration. As a result, sensitive credentials and configuration data are exposed, potentially enabling an attacker to impersonate the monitoring service or tamper with monitoring information. The weakness is classified as CWE\u2011276.", "risk_and_exploitability": "The CVSS score of 6.8 indicates medium severity, while the EPSS score of less than 1\u202f% suggests a low likelihood of commercial exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local user access; an attacker with local privileges can simply read the protected folder. Remote exploitation is not feasible without local access. In environments where local accounts have elevated privileges or where lateral movement is possible, the exposure of private keys could be critical."}}}}, "created": "2026-01-30T08:43:08.453662+00:00", "updated": "2026-04-18T14:45:03.116489+00:00", "vendors": ["icinga", "icinga$PRODUCT$icinga"]}