CVE-2026-24413
📋 TL;DR
The Icinga 2 MSI installer on Windows sets overly permissive folder permissions, allowing all local users to read sensitive files including private keys and configuration data. This affects all Windows installations of Icinga 2 versions 2.3.0 through 2.13.13, 2.14.7, and 2.15.1. Attackers with local access can steal credentials and potentially compromise the monitoring system.
💻 Affected Systems
- Icinga 2
- Icinga for Windows
📦 What is this software?
Icinga by Icinga
Icinga by Icinga
Icinga by Icinga
⚠️ Risk & Real-World Impact
Worst Case
Local attackers steal private keys and configuration files, enabling them to impersonate the Icinga service, access monitored systems, or modify monitoring data.
Likely Case
Unauthorized local users read sensitive configuration data and private keys, potentially leading to credential theft and lateral movement.
If Mitigated
With proper ACLs, only authorized service accounts and administrators can access sensitive files, preventing credential exposure.
🎯 Exploit Status
Exploitation requires local user access but is trivial - attackers simply need to browse to the vulnerable folder and read files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Icinga 2: 2.13.14, 2.14.8, or 2.15.2; Icinga for Windows: v1.13.4, v1.12.4, or v1.11.2
Vendor Advisory: https://icinga.com/blog/releasing-icinga-2-v2-15-2-v2-14-8-v2-13-14-and-icinga-for-windows-v1-13-4-v1-12-4-v1-11-2
Restart Required: Yes
Instructions:
1. Upgrade Icinga 2 to version 2.13.14, 2.14.8, or 2.15.2. 2. Upgrade Icinga for Windows to v1.13.4, v1.12.4, or v1.11.2. 3. Restart Icinga services.
🔧 Temporary Workarounds
Manual ACL Update
windowsManually set restrictive permissions on vulnerable folders to prevent unauthorized access.
icacls "C:\ProgramData\icinga2\var" /inheritance:r /grant:r "NT SERVICE\icinga2:(OI)(CI)F" "Administrators:(OI)(CI)F"
icacls "C:\Program Files\WindowsPowerShell\modules\icinga-powershell-framework\certificate" /inheritance:r /grant:r "NT SERVICE\icinga2:(OI)(CI)F" "Administrators:(OI)(CI)F"
🧯 If You Can't Patch
- Immediately apply manual ACL workaround to restrict folder access
- Rotate all certificates and keys stored in vulnerable folders after securing permissions
🔍 How to Verify
Check if Vulnerable:
Check folder permissions: icacls "C:\ProgramData\icinga2\var" - if 'BUILTIN\Users' or similar groups have read access, system is vulnerable.Check Version:
icinga2 --versionVerify Fix Applied:
Verify folder permissions: icacls "C:\ProgramData\icinga2\var" - only NT SERVICE\icinga2 and Administrators should have access.📡 Detection & Monitoring
Log Indicators:
- Windows Security logs showing unauthorized access attempts to icinga2 folders
- Icinga logs showing certificate validation failures
Network Indicators:
- Unusual connections from Icinga server to monitored systems
- Certificate validation errors in TLS connections
SIEM Query:
EventID=4663 AND ObjectName LIKE '%icinga2%var%' AND Accesses LIKE '%ReadData%' AND SubjectUserName NOT IN ('NT SERVICE\\icinga2', 'Administrator')