Icinga
CVE-2026-61637: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL
CVE-2026-61637 Nov 11, 2026 Source: Vendor
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. For this to succeed, the victim's locale in Icinga Web must be different from en_US. This issue has been patched in versions 2.12.7 and 2.13.1.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-61637
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
0 lines
No credit lines recorded on this release yet.