---
id: "CVE-2026-61637"
page: "https://infrastack.ai/live/CVE-2026-61637"
kind: "vulnerability"
aliases: ["CVE-2026-61637"]
title: "Icinga Web 2: crafted URL redirects logged-in users to any location"
severity: "low"
cvss: 3.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["icinga-web-2", "monitoring", "package", "self-hosted"]
not_affected_if: ["en-us-locale-only", "no-authenticated-users-exposed"]
published_at: "2026-11-11T19:17:42+00:00"
first_seen_at: "2026-11-11T19:28:47+00:00"
updated_at: "2026-11-11T19:30:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61637", "first_seen_at": "2026-11-11T19:28:47+00:00"}]
exploit_sources: []
---

# Icinga Web 2: crafted URL redirects logged-in users to any location

Link for people: https://infrastack.ai/live/CVE-2026-61637 (this .md is for agents)

Icinga Web 2, a monitoring web interface, can be made to redirect a signed-in user to an attacker-chosen site when the user's locale is not en_US. The attacker needs to get an authenticated user to visit a crafted URL.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Icinga Web 2 version with `icingacli --version` or the package manager; versions below `2.12.7` on the 2.12 line or below `2.13.1` on the 2.13 line are affected.
- Check whether users have a non-English locale set in Icinga Web.

## Fix

- Upgrade to `2.12.7` on the 2.12 line.
- Upgrade to `2.13.1` on the 2.13 line.

## Timeline

- 2026-11-11T19:28:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61637

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Icinga/icingaweb2/security/advisories/GHSA-w7c2-xjv9-q8fv

## From the sources

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. For this to succeed, the victim's locale in Icinga Web must be different from en_US. This issue has been patched in versions 2.12.7 and 2.13.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_