Icinga Updates

Latest: Icinga 2 v2.16.5 · 18 Aug 2026 - This release contains a bugfix for a regression in the IcingaDB feature that was introduced in v2.16.0 and some security enhancements that fix a couple of minor vulnerabilities. One vulnerability allowed an authenticated ApiUser with the events/* permission to obtain information about objects through crafted filter expressions, without holding the relevant objects/query/* permission. The fix is to correctly apply permissions to filter expressions on /v1/events . The other vulnerability allowed an authenticated Icinga 2 node to use the ~1 GB message limit to possibly crash another node through memory exhaustion. Depending on available memory, multiple compromised nodes may be required for a successful attack since a node can only make one connection. The fix applies a 16 MiB limit to messages from nodes lower in the hierarchy. Security Enhancements Apply user permissions to filter expressions for /v1/events similarly to /v1/objects ( GHSA-v265-w3gm-99vg ) Introduce an additional 16 MiB message size limit on all child-zone connections ( GHSA-wm63-p2jg-5665 ) Don't include sensitive certificate request tickets in log messages ( #10960 ) Don't log full object config containing potentially sensitive information ( #10988 ) Bugfixes IcingaDB: Fix multiple potential race conditions during initial config dump ( #10981 )