{"id":"CVE-2026-61637","kind":"vulnerability","aliases":["CVE-2026-61637"],"related":[],"title":"Icinga Web 2: crafted URL redirects logged-in users to any location","description":"Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. For this to succeed, the victim's locale in Icinga Web must be different from en_US. This issue has been patched in versions 2.12.7 and 2.13.1.","summary":"Icinga Web 2, a monitoring web interface, can be made to redirect a signed-in user to an attacker-chosen site when the user's locale is not en_US. The attacker needs to get an authenticated user to visit a crafted URL.","severity":"low","cvss":3.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["icinga-web-2","monitoring","package","self-hosted"],"not_affected_if":["en-us-locale-only","no-authenticated-users-exposed"],"how_to_check":"- Check the installed Icinga Web 2 version with `icingacli --version` or the package manager; versions below `2.12.7` on the 2.12 line or below `2.13.1` on the 2.13 line are affected.\n- Check whether users have a non-English locale set in Icinga Web.","fix":"- Upgrade to `2.12.7` on the 2.12 line.\n- Upgrade to `2.13.1` on the 2.13 line.","status":"open","published_at":"2026-11-11T19:17:42+00:00","first_seen_at":"2026-11-11T19:28:47+00:00","triaged_at":"2026-11-11T19:30:42+00:00","updated_at":"2026-11-11T19:30:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T19:30:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `2.12.7` on the 2.12 line.\n- Upgrade to `2.13.1` on the 2.13 line.","reach":"internet","title":"Icinga Web 2: crafted URL redirects logged-in users to any location","impact":"low","summary":"Icinga Web 2, a monitoring web interface, can be made to redirect a signed-in user to an attacker-chosen site when the user's locale is not en_US. The attacker needs to get an authenticated user to visit a crafted URL.","audience":"businesses","category":"package","nicknames":[],"who_cares":["icinga-web-2","self-hosted","monitoring"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Signed-in users get redirected to an attacker-chosen external site.","analyst_note":"","how_to_check":"- Check the installed Icinga Web 2 version with `icingacli --version` or the package manager; versions below `2.12.7` on the 2.12 line or below `2.13.1` on the 2.13 line are affected.\n- Check whether users have a non-English locale set in Icinga Web.","plain_action":"","product_name":"icingaweb2","needs_analyst":false,"not_affected_if":["en-us-locale-only","no-authenticated-users-exposed"],"who_is_affected":"Teams that run Icinga Web 2 as a monitoring dashboard for their own systems are exposed when users have a locale other than en_US. The attacker must lure an already logged-in user to a crafted link. Installations where every user uses en_US are not affected by this specific condition.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000762,"input_tokens":4617,"output_tokens":600,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-61637':16A,19A '2':3A,23B,31B,76C '2.12.7':93C,152C '2.13.1':95C,154C 'abl':113C 'allow':116C 'attack':49B,62B,97C 'attacker-chosen':48B 'authent':67B,107C,115C 'backend':120C 'chosen':50B 'command':87C 'command-lin':86C 'craft':4A,72B,99C 'cve':14A,17A 'differ':141C 'en':59B,143C 'framework':84C 'get':65B 'host':28B 'icinga':1A,21B,29B,74C,137C 'icinga-web':20B 'interfac':35B,83C,89C 'issu':146C 'line':88C 'local':56B,135C 'locat':13A,127C 'log':8A 'logged-in':7A 'made':38B 'manipul':118C 'monitor':24B,33B,81C 'must':139C 'need':63B 'one':110C 'open':79C 'packag':25B 'patch':149C 'prior':90C 'redirect':6A,40B,122C 'self':27B 'self-host':26B 'sign':43B 'signed-in':42B 'site':51B 'sourc':80C 'succeed':131C 'url':5A,73B,101C 'us':60B,144C 'user':10A,45B,54B,68B,108C,124C 'version':92C,151C 'victim':133C 'visit':70B,104C 'web':2A,22B,30B,34B,75C,82C,138C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Icinga Web 2 as a monitoring dashboard for their own systems are exposed when users have a locale other than en_US. The attacker must lure an already logged-in user to a crafted link. Installations where every user uses en_US are not affected by this specific condition.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["icingaweb2","low","monitoring","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':15A,18A '-61637':16A,19A '2':3A 'craft':4A 'cve':14A,17A 'icinga':1A 'locat':13A 'log':8A 'logged-in':7A 'redirect':6A 'url':5A 'user':10A 'web':2A","search_b":"'2':23B,31B 'attack':49B,62B 'attacker-chosen':48B 'authent':67B 'chosen':50B 'craft':72B 'en':59B 'get':65B 'host':28B 'icinga':21B,29B 'icinga-web':20B 'interfac':35B 'local':56B 'made':38B 'monitor':24B,33B 'need':63B 'packag':25B 'redirect':40B 'self':27B 'self-host':26B 'sign':43B 'signed-in':42B 'site':51B 'url':73B 'us':60B 'user':45B,54B,68B 'visit':70B 'web':22B,30B,34B","search_c":"'2':76C '2.12.7':93C,152C '2.13.1':95C,154C 'abl':113C 'allow':116C 'attack':97C 'authent':107C,115C 'backend':120C 'command':87C 'command-lin':86C 'craft':99C 'differ':141C 'en':143C 'framework':84C 'icinga':74C,137C 'interfac':83C,89C 'issu':146C 'line':88C 'local':135C 'locat':127C 'manipul':118C 'monitor':81C 'must':139C 'one':110C 'open':79C 'patch':149C 'prior':90C 'redirect':122C 'sourc':80C 'succeed':131C 'url':101C 'us':144C 'user':108C,124C 'version':92C,151C 'victim':133C 'visit':104C 'web':75C,82C,138C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-03T13:53:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61637","severity":null,"published_at":"2026-11-11T19:17:42+00:00","modified_at":"2026-11-11T19:17:42+00:00","first_seen_at":"2026-11-11T19:28:47+00:00","fetched_at":"2026-11-11T19:28:47+00:00","note":null}],"documents":[{"id":128137,"url":"https://github.com/Icinga/icingaweb2/security/advisories/GHSA-w7c2-xjv9-q8fv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-03T13:53:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}