What is the CVSS score of CVE-2025-61907?

CVE-2025-61907 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2025-61907?

Within 24 hours, inventory all Icinga 2 instances, identify any running versions 2.4 through 2.15.0, restrict API access to trusted networks where possible, review API user permissions for variables and objects/query, and rotate the TicketSalt if unauthorized API access is suspected. Within 7 days, deploy the Vendor-released patch: 2.15.1, 2.14.7, and 2.13.13, prioritizing internet-facing or broadly accessible APIs and testing in a non-production environment first. Within 30 days, validate the upgrades, rotate all potentially exposed secrets, enforce least-privilege API roles, and add monitoring for unusual /v1/objects query activity.

Icinga 2 CVE-2025-61907

HIGH

Information Exposure (CWE-200)

2025-10-16 security-advisories@github.com

Information Disclosure Icinga

7.1

CVSS 4.0 · Vendor: github

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain low-privileged API credentials
Delivery

Craft filter expression referencing restricted globals/objects
Exploit

Submit to /v1/objects endpoint
Execution

Server evaluates against full namespace
Impact

Exfiltrate TicketSalt and hidden objects

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires an authenticated Icinga 2 API user (PR:L) who already holds some API permissions but is deliberately restricted via the `variables` permission and/or `objects/query` object filters - exploitation is the act of using filter expressions on the /v1/objects endpoints to escape those exact restrictions. Affected only in versions 2.4 through 2.15.0; the API must be enabled and reachable. Limiting factors: valid API credentials are mandatory (not anonymous/unauthenticated), impact is confidentiality-only with no modification or DoS, and the practical value hinges on whether sensitive globals such as TicketSalt or restricted config objects exist in the environment.
Impact	This is a moderate-severity information disclosure flaw (CWE-200) that is a real but not urgent priority. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires PR:L - an authenticated API user with existing but limited permissions - which meaningfully narrows the attacker population to insiders or anyone who has already obtained valid API credentials. Impact is bounded to confidentiality (VC:H, VI:N, VA:N): the bug lets a user bypass the `variables` and `objects/query` permission checks via filter expressions on /v1/objects endpoints. The source diff confirms the leak includes the sensitive `TicketSalt` global (the subsequent-system SC:L in the vector reflects this, since TicketSalt enables forging node registration tickets), so this is more than benign metadata exposure. The exploitation-probability signals are modest and mutually consistent: EPSS is 0.40% (33rd percentile), there is no CISA KEV listing, and no public exploit was identified - nothing here contradicts the other signals. No SSVC decision data was provided in the input. Net: patch on a normal cadence; prioritize sooner only where untrusted/low-privilege API users exist or where leaked TicketSalt would be high-value.
Exploit ScenarioDerived	An authenticated Icinga 2 API user with only limited object/variable permissions sends a request to a /v1/objects endpoint containing a crafted filter expression that references globals or objects outside their granted scope. The server evaluates the filter against the full global namespace and returns or reveals data the user should not see, including the TicketSalt global and otherwise-restricted config objects. No public exploit code was identified, but the fix commit documents the exact leak path, lowering the barrier to reproduction.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 09, 2026

Information disclosure in Icinga 2 versions 2.4 through 2.15.0 allows an authenticated API user to escape the very restrictions meant to constrain them: filter expressions submitted to the /v1/objects endpoints can reach global variables (including the sensitive TicketSalt) and configuration objects that the user's variables and objects/query permissions explicitly deny. Exploitation requires valid API credentials plus a reachable API and is confidentiality-only - no modification or denial of service - giving it moderate severity (CVSS 3.1 7.1-class impact with scope change, C:H/I:N/A:N) rather than an urgent one. Vendor-released fixes are available in 2.15.1, 2.14.7, and 2.13.13; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at roughly 0.40% (33rd percentile).

RemediationAI

Vendor-released patch: upgrade to Icinga 2.15.1, 2.14.7, or 2.13.13 depending on your maintenance branch (advisory: https://github.com/Icinga/icinga2/security/advisories/GHSA-gg32-w9rm-vp2v; upstream fix commit: https://github.com/Icinga/icinga2/commit/56255ac7a689b9e198742d2fca6f7459a54c85a3). Until upgrading, treat any API user whose access is enforced only through filter expressions as potentially able to read anything the API process can see - the reliable compensating control is to stop relying on variables/objects/query filter restrictions and instead fully remove the variables and objects/query permissions from untrusted API accounts (side effect: those accounts lose legitimate object-query functionality entirely, which may break dashboards or integrations). Additionally, restrict API exposure to trusted management networks or a reverse proxy with allow-listing, since valid credentials plus reachability are the only prerequisites (side effect: remote integrations and agents connecting from other networks will fail unless allowed explicitly); if API accounts cannot be trimmed, disabling the /v1/objects endpoints or the API service itself is the strongest mitigation but breaks Icinga Web 2 and agent/API integrations. Because the leaked global namespace explicitly includes TicketSalt, rotate TicketSalt after upgrading and audit agent registrations and API access logs for evidence that tickets were forged or restricted objects were enumerated; rotate credentials for any over-privileged or low-trust API user as a precaution.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Icinga 2 is a monitoring system whose REST API exposes /v1/objects endpoints backed by an embedded DSL interpreter used to evaluate user-supplied filter expressions. Those expressions run inside ScriptFrame objects, thread-local execution contexts that were designed to track whether execution is "Sandboxed" and what a caller is permitted to see. The root cause (CWE-200) is that ScriptFrame bound its Self reference directly to the global namespace via ScriptGlobal::GetGlobals() without any permission mediation, so a filter expression evaluated in a sandboxed context could still resolve global variables and ConfigObject instances outside the caller's authorization. The upstream fix introduces a ScriptPermissionChecker with CanAccessGlobalVariable() and CanAccessConfigObject() hooks, threads a PermChecker pointer through inherited frames, and adds a lazily built, cached sanitized copy of the global namespace (ScriptFrame::Globals). That sanitized namespace explicitly omits TicketSalt and any key the permission checker rejects, while deliberately retaining the Types, System, and Icinga sub-namespaces because ScopeExpression expects them. The scope change in the assessed vector (S:C) reflects that the leak crosses a security boundary - the API scripting context reads data belonging to resources outside its authorized scope - while the C:H score reflects that disclosure of TicketSalt or restricted config objects can be materially sensitive, particularly since TicketSalt underpins Icinga agent ticket signing.

Know when Icinga gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

vuln.today AI 7.7 HIGH

Network API with low-privileged auth (PR:L) and no UI; confidentiality-only (C:H, I/A:N), and S:C because leaked TicketSalt crosses the security authority into node-registration trust.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

None

Vulnerable system: Availability

None

Subsequent system: Confidentiality

Low

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information that should be hidden from them, including global variables not permitted by the variables permission and objects not permitted by the corresponding objects/query permissions. The vulnerability is fixed in versions 2.15.1, 2.14.7, and 2.13.13.

Executive ViewAI

Why It Matters

Organizations running Icinga 2 versions 2.4 through 2.15.0 face a high-severity information disclosure that can allow API users with valid credentials to retrieve sensitive global variables, including the TicketSalt, and configuration objects their permissions are designed to restrict. No public exploit identified at time of analysis, and vendor-released patches are available in 2.15.1, 2.14.7, and 2.13.13. Leadership should prioritize remediation because the affected monitoring platform may expose security-sensitive secrets and data to users who should not have access, potentially weakening trust in the monitoring environment.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.4%

Top 67% exploitable

Prevalence

Medium

popular open-source monitoring tool, common in ops but not ubiquitous

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +36

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.