CVE-2026-61637 · Package
NO FIX YET · SEE WHAT TO DO
Icinga Web 2, a monitoring web interface, can be made to redirect a signed-in user to an attacker-chosen site when the user's locale is not en_US. The attacker needs to get an authenticated user to visit a crafted URL.
first public Jul 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run Icinga Web 2 as a monitoring dashboard for their own systems are exposed when users have a locale other than en_US. The attacker must lure an already logged-in user to a crafted link. Installations where every user uses en_US are not affected by this specific condition.
Not affected if en-us-locale-only, no-authenticated-users-exposed
Who cares icinga-web-2, monitoring, self-hosted
icingacli --version or the package manager; versions below 2.12.7 on the 2.12 line or below 2.13.1 on the 2.13 line are affected.2.12.7 on the 2.12 line.2.13.1 on the 2.13 line.Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. For this to succeed, the victim's locale in Icinga Web must be different from en_US. This issue has been patched in versions 2.12.7 and 2.13.1.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.