CVE Explorer

CVE-2026-24413

Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set appropriate permissions for the `%ProgramData%\icinga2\var` folder on Windows. This resulted in the its contents - including the private key of the user and synced configuration - being readable by all local users. All installations on Windows are affected. Versions 2.13.14, 2.14.8, and 2.15.2 contains a fix. There are two possibilities to work a

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:52be5c940f555bb9e0408e7b64b4db4f6650798d170f0e8647dc6a0aa3249e3c

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"icinga2","vendor":"Icinga","versions":[{"status":"affected","version":">= 2.3.0, < 2.13.14"},{"status":"affected","version":">= 2.14.0, < 2.14.8"},{"status":"affected","version":">= 2.15.0, < 2.15.2"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:839fce5a5d92097cf01eacf021e6ca11b2b71b48215897c8fd7f4101c4fb7f48 · sha256:280844440fa2ed90… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":6.8,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:839fce5a5d92097cf01eacf021e6ca11b2b71b48215897c8fd7f4101c4fb7f48 · sha256:280844440fa2ed90… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-276","description":"CWE-276: Incorrect Default Permissions","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:839fce5a5d92097cf01eacf021e6ca11b2b71b48215897c8fd7f4101c4fb7f48 · sha256:280844440fa2ed90… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions

{"name":"https://github.com/Icinga/icinga-powershell-framework/security/advisories/GHSA-88h5-rrm6-5973","tags":["x_refsource_MISC"],"url":"https://github.com/Icinga/icinga-powershell-framework/security/advisories/GHSA-88h5-rrm6-5973"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:839fce5a5d92097cf01eacf021e6ca11b2b71b48215897c8fd7f4101c4fb7f48 · sha256:280844440fa2ed90… · /containers/cna/references/1

{"name":"https://github.com/Icinga/icinga2/security/advisories/GHSA-vfjg-6fpv-4mmr","tags":["x_refsource_CONFIRM"],"url":"https://github.com/Icinga/icinga2/security/advisories/GHSA-vfjg-6fpv-4mmr"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:839fce5a5d92097cf01eacf021e6ca11b2b71b48215897c8fd7f4101c4fb7f48 · sha256:280844440fa2ed90… · /containers/cna/references/0

{"name":"https://icinga.com/blog/releasing-icinga-2-v2-15-2-v2-14-8-v2-13-14-and-icinga-for-windows-v1-13-4-v1-12-4-v1-11-2","tags":["x_refsource_MISC"],"url":"https://icinga.com/blog/releasing-icinga-2-v2-15-2-v2-14-8-v2-13-14-and-icinga-for-windows-v1-13-4-v1-12-4-v1-11-2"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:839fce5a5d92097cf01eacf021e6ca11b2b71b48215897c8fd7f4101c4fb7f48 · sha256:280844440fa2ed90… · /containers/cna/references/2

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer