CVE-2021-32739

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a read-ony user's credentials, an attacker can view most attributes of all config objects including `ticket_salt` of `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the master node's certificate, and a self-signed certificate are enough to successfully request the desired certificate from Icinga. That certificate may in turn be used to steal an endpoint or API user's identity. Versions 2.12.5 and 2.11.10 both contain a fix the vulnerability. As a workaround, one may either specify queryable types explicitly or filter out ApiListener objects.

• CWE-267
• CWE-269

• https://github.com/Icinga/icinga2/security/advisories/GHSA-98wp-jc6q-x5q5Exploit, Third Party Advisory
• https://icinga.com/blog/2021/07/02/releasing-icinga-2-12-5-2-11-10/Broken Link, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2021/11/msg00010.htmlMailing List, Third Party Advisory
• https://github.com/Icinga/icinga2/security/advisories/GHSA-98wp-jc6q-x5q5Exploit, Third Party Advisory
• https://icinga.com/blog/2021/07/02/releasing-icinga-2-12-5-2-11-10/Broken Link, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2021/11/msg00010.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2024/11/msg00010.html

Published

Jul 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32733Nextcloud Text is a collaborative document editing applicati…6.1
• CVE-2021-32734Nextcloud Server is a Nextcloud package that handles data st…5.3
• CVE-2021-32735Kirby is a content management system. In Kirby CMS versions …5.4
• CVE-2021-32736think-helper defines a set of helper functions for ThinkJS. …7.5
• CVE-2021-32737Sulu is an open-source PHP content management system based o…4.8
• CVE-2021-32738js-stellar-sdk is a Javascript library for communicating wit…6.5
• CVE-2021-32740Addressable is an alternative implementation to the URI impl…7.5
• CVE-2021-32741Nextcloud Server is a Nextcloud package that handles data st…5.3
• CVE-2021-32742Vapor is a web framework for Swift. In versions 4.47.1 and p…9.1
• CVE-2021-32743Icinga is a monitoring system which checks the availability …8.8
• CVE-2021-32744Collabora Online is a collaborative online office suite. In …7.5
• CVE-2021-32745Collabora Online is a collaborative online office suite. A r…6.1