Critical Icinga 2 Vulnerability Allows Attackers to Obtain Valid Certificates

A critical vulnerability (CVE-2025-48057) has been discovered in Icinga 2, the widely used open-source monitoring platform.

The flaw, affecting installations built with OpenSSL versions older than 1.1.0, could allow attackers to obtain valid certificates from the Icinga Certificate Authority (CA), potentially impersonating trusted nodes and compromising monitoring environments.

Security updates have been released in versions 2.14.6, 2.13.12, and 2.12.12, and immediate action is urged for affected systems.

Exploiting Certificate Validation

At the heart of this security issue lies the VerifyCertificate() function.

In vulnerable Icinga 2 builds (using OpenSSL <1.1.0), this function can be tricked into treating malicious certificates as valid.

Specifically, OpenSSL versions before 1.1.0 maintained a “valid” flag within the certificate object.

If set by a previous operation, this flag could cause critical verification steps to be skipped, resulting in improper validation of certificate requests.

Attackers exploiting this flaw could send a crafted certificate request that appears as a renewal of an existing certificate.

If the Icinga 2 master node (with CA signing capability) is accessible via TLS, the attacker could obtain a valid certificate, enabling them to impersonate trusted nodes within the monitoring cluster.

Technical Verification Command:

bashicinga2 --version | grep OpenSSL

If the output indicates OpenSSL 1.1.0 or newer, the installation is not affected.

Impact and Affected Platforms

This vulnerability is rated critical, with a CVSS v4.0 score of 9.3, reflecting its high potential impact on confidentiality, integrity, and availability.

The flaw primarily affects systems running Icinga 2 on platforms like RHEL 7 and Amazon Linux 2, which ship with OpenSSL 1.0.2 by default.

Table: Affected and Patched Versions

Icinga 2 Version	Vulnerable (OpenSSL <1.1.0)	Patched Version
≤ 2.14.5	Yes	2.14.6
≤ 2.13.11	Yes	2.13.12
≤ 2.12.11	Yes	2.12.12

Patches, Workarounds, and Recommendations

Security Fixes

The vulnerability has been addressed in Icinga 2 versions 2.14.6, 2.13.12, and 2.12.12. These releases also include:

• A fix for a use-after-free bug in VerifyCertificate(), which previously could result in incorrect error codes in logs.
• An update to OpenSSL v3.0.16 for Windows builds.
• Various minor build and documentation improvements.

Immediate Actions

• Upgrade: Users running Icinga 2 on OpenSSL 1.0.2 or older must upgrade to a patched version immediately.
• Restrict Access: Limit network access to Icinga 2 master nodes capable of signing certificates to only trusted entities.
• Temporary Workaround: Stop the master from signing new certificates by renaming the /var/lib/icinga2/ca directory. Note: This will halt new node setups and certificate renewals, making it a short-term solution only.

Example Workaround Command

bashmv /var/lib/icinga2/ca /var/lib/icinga2/ca.disabled

Organizations using Icinga 2 with OpenSSL versions older than 1.1.0 face a severe risk of certificate-based impersonation attacks.

Immediate patching is essential to maintain the integrity and security of monitoring environments.

For full technical details and source code, consult the official Icinga repositories and advisories.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!