Icinga 2 v2.16.5

This release contains a bugfix for a regression in the IcingaDB feature that was introduced in v2.16.0 and some security enhancements that fix a couple of minor vulnerabilities.

One vulnerability allowed an authenticated ApiUser with the events/* permission to obtain information about objects through crafted filter expressions, without holding the relevant objects/query/* permission. The fix is to correctly apply permissions to filter expressions on /v1/events.

The other vulnerability allowed an authenticated Icinga 2 node to use the ~1 GB message limit to possibly crash another node through memory exhaustion. Depending on available memory, multiple compromised nodes may be required for a successful attack since a node can only make one connection. The fix applies a 16 MiB limit to messages from nodes lower in the hierarchy.

Security Enhancements

• Apply user permissions to filter expressions for /v1/events similarly to /v1/objects (GHSA-v265-w3gm-99vg)
• Introduce an additional 16 MiB message size limit on all child-zone connections (GHSA-wm63-p2jg-5665)
• Don't include sensitive certificate request tickets in log messages (#10960)
• Don't log full object config containing potentially sensitive information (#10988)

Bugfixes

• IcingaDB: Fix multiple potential race conditions during initial config dump (#10981)

Icinga 2 v2.15.6

This release contains some security enhancements that fix a couple of minor vulnerabilities.

One vulnerability allowed an authenticated ApiUser with the events/* permission to obtain information about objects through crafted filter expressions, without holding the relevant objects/query/* permission. The fix is to correctly apply permissions to filter expressions on /v1/events.

The other vulnerability allowed an authenticated Icinga 2 node to use the ~1 GB message limit to possibly crash another node through memory exhaustion. Depending on available memory, multiple compromised nodes may be required for a successful attack since a node can only make one connection. The fix applies a 16 MiB limit to messages from nodes lower in the hierarchy.

Security Enhancements

• Apply user permissions to filter expressions for /v1/events similarly to /v1/objects (GHSA-v265-w3gm-99vg)
• Introduce an additional 16 MiB message size limit on all child-zone connections (GHSA-wm63-p2jg-5665)
• Don't include sensitive certificate request tickets in log messages (#10987)
• Don't log full object config containing potentially sensitive information (#10989)

Icinga 2 v2.16.4

This release contains a number of fixes for various smaller but annoying bugs, including one regression regarding API authentication with certain HTTP client libraries. It also ensures that Icinga 2 is compatible with newer OpenSSL versions.

Bugfixes

• Track objects deleted at runtime to avoid erroneous recreation when processing the replay log (#10933)
• Ensure that connecting to endpoints can no longer hang indefinitely, which had stopped it from initiating further connection attempts until Icinga 2 was restarted (#10929)
• Fix a regression introduced with v2.16.0, that broke API authentication for clients that only send HTTP Basic Auth credentials after the server requested them (#10927)
• Improve locking of performance data arrays to prevent possible deadlocks (#10930)
• Fix high response latency with multiple API requests targeting non-existent hosts or services (#10928)

Enhancements and Documentation

• Add support for OpenSSL 4.0 (#10934)
• Remove Amazon Linux 2 from the documentation after it has reached its end of life (#10935)

Icinga 2 v2.16.3

This is a hotfix release that fixes a regression with the Json.decode() DSL function that was introduced in v2.16.2: The addition of a second argument to the internal JsonDecode() function unintentionally leaked into the DSL as a required argument. This version restores the old and intended behavior of Json.decode().

Changes

• Restore single-argument Json.decode() in the DSL (#10921)
• Add the upgrading documentation for v2.15.1 again, which went missing with the v2.16.0 release (#10916)

Icinga 2 v2.15.5

This is a hotfix release that fixes a regression with the Json.decode() DSL function that was introduced in v2.15.4: The addition of a second argument to the internal JsonDecode() function unintentionally leaked into the DSL as a required argument. This version restores the old and intended behavior of Json.decode().

Changes

• Restore single-argument Json.decode() in the DSL (#10920)

Icinga 2 v2.14.10

This is a hotfix release that fixes a regression with the Json.decode() DSL function that was introduced in v2.14.9: The addition of a second argument to the internal JsonDecode() function unintentionally leaked into the DSL as a required argument. This version restores the old and intended behavior of Json.decode().

Changes

• Restore single-argument Json.decode() in the DSL (#10922)

Icinga 2 v2.16.2

This release fixes some critical security vulnerabilities in Icinga 2. Users are advised to upgrade immediately, as two of them allow an unauthenticated attacker to take over or crash the Icinga 2 process over the network. The other security fixes only affect authenticated API users.

In addition, a new permission named filter-expression is introduced, which allows specifying if individual API users are allowed to use DSL filter expressions in API queries. This allows further restricting some API users that don't need this capability, for example, those only submitting individual check results. Due to the incompatibility of this change, enforcement of this permission is opt-in until v2.17; see the upgrading docs for details.

• Verify that certificate update requests come from an authorized endpoint (GHSA-vj39-ww8j-vvx5, CVE-2026-61550)
• Fix stack overflow due to deeply nested data structures (GHSA-wh38-wg57-5w7g, CVE-2026-61551)
• Prevent arbitrary config injection on object creation via the API (GHSA-jgqj-x5j9-vgcm, CVE-2026-61552)
• Fix that /v1/config/files could send uninitialized memory in case of file I/O errors (#10871)
• Add filter-expression permission to make it possible to prevent API users from using DSL filter expressions
• Windows: Update bundled OpenSSL to v3.5.7 (#10893)

Icinga 2 v2.15.4

This release fixes some critical security vulnerabilities in Icinga 2. Users are advised to upgrade immediately, as two of them allow an unauthenticated attacker to take over or crash the Icinga 2 process over the network. The other security fixes only affect authenticated API users.

In addition, a new permission named filter-expression is introduced, which allows specifying if individual API users are allowed to use DSL filter expressions in API queries. This allows further restricting some API users that don't need this capability, for example, those only submitting individual check results. Due to the incompatibility of this change, enforcement of this permission is opt-in until v2.17; see the upgrading docs for details.

• Verify that certificate update requests come from an authorized endpoint (GHSA-vj39-ww8j-vvx5, CVE-2026-61550)
• Fix stack overflow due to deeply nested data structures (GHSA-wh38-wg57-5w7g, CVE-2026-61551)
• Prevent arbitrary config injection on object creation via the API (GHSA-jgqj-x5j9-vgcm, CVE-2026-61552)
• Add filter-expression permission to make it possible to prevent API users from using DSL filter expressions
• Windows: Update bundled OpenSSL to v3.0.21 (#10876)

Icinga 2 v2.14.9

This release fixes some critical security vulnerabilities in Icinga 2. Users are advised to upgrade immediately, as two of them allow an unauthenticated attacker to take over or crash the Icinga 2 process over the network. The other security fixes only affect authenticated API users.

In addition, a new permission named filter-expression is introduced, which allows specifying if individual API users are allowed to use DSL filter expressions in API queries. This allows further restricting some API users that don't need this capability, for example, those only submitting individual check results. Due to the incompatibility of this change, enforcement of this permission is opt-in until v2.17; see the upgrading docs for details.

• Verify that certificate update requests come from an authorized endpoint (GHSA-vj39-ww8j-vvx5, CVE-2026-61550)
• Fix stack overflow due to deeply nested data structures (GHSA-wh38-wg57-5w7g, CVE-2026-61551)
• Prevent arbitrary config injection on object creation via the API (GHSA-jgqj-x5j9-vgcm, CVE-2026-61552)
• Add filter-expression permission to make it possible to prevent API users from using DSL filter expressions
• Windows: Update bundled OpenSSL to v3.0.21 (#10894)

Icinga 2 v2.16.1

This is a small release mostly to fix the issues some users were encountering in connection with perfdata writers, mostly Graphite and InfluxDB. The only significant change is that the changes from #10668 and #10799 are being reverted. This affects ElasticsearchWriter, GraphiteWriter, GelfWriter, InfluxdbWriter, Influxdb2Writer and OpenTsdbWriter.

Changes

• Revert adding PerfdataWriterConnection: #10851
• Docs: Note OTLP metrics package limitation on Debian 11 and Ubuntu 22.04 and Amazon Linux 2: #10837