CVE-2025-61789: Icinga DB Web hidden/protected custom variables are prone to filter enumeration

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-16 · updated 2026-10-09
Weakness: CWE-204

Description

Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values assigned to it. Versions 1.1.4 and 1.2.3 respond with an error if such a custom variable is used.

Affected products

icingadb-web: before 1.1.4; from 1.2.0 before 1.2.3 — fixed in 1.1.4, 1.2.3

How to fix

Upgrade to a fixed version: icingadb-web 1.1.4, 1.2.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-61789 or the next vulnerability affects your stack