Bug 2571832 (CVE-2026-61637) - CVE-2026-61637 icingaweb2: icingaweb2: Open redirect via crafted URL
Summary: CVE-2026-61637 icingaweb2: icingaweb2: Open redirect via crafted URL
Keywords:
Status: NEW
Alias: CVE-2026-61637
Product: Security Response
Classification: Other
Component: vulnerability-draft
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-11 18:31 UTC by OSIDB Bzimport
Modified: 2026-11-11 18:37 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-11 18:31:25 UTC 
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. For this to succeed, the victim's locale in Icinga Web must be different from en_US. This issue has been patched in versions 2.12.7 and 2.13.1.
Note You need to log in before you can comment on or make changes to this bug.