Icinga 2 versions >=2.4 <2.14.9, >=2.15.0 <2.15.4, and >=2.16.0 <2.16.2 contain a code injection vulnerability (CWE-94) in the /v1/objects API. This API writes attacker-controlled template names into the generated configuration without escaping, allowing an authenticated ApiUser with objects/create/* permission to inject arbitrary Icinga 2 DSL code. This injection can escape the intended object boundaries, create additional objects, and exceed the user's assigned privileges. The vulnerability is addressed by fixes in versions 2.14.9, 2.15.4, and 2.16.2.

Successful exploitation allows an authenticated user with objects/create/* permission to perform code injection in the Icinga 2 configuration. This can lead to privilege escalation beyond assigned rights, potentially compromising the integrity and availability of the monitoring system. The CVSS 3.1 base score is 7.2 (High), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Upgrade Icinga 2 to version 2.14.9, 2.15.4, or 2.16.2 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed fixed in these versions.