What is CVE-2021-37698?

CVE-2021-37698 is a high-severity vulnerability in Icinga, classified under Improper Certificate Validation. CVSS score: 7.5/10. Published 2021-08-19.

How severe is CVE-2021-37698?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Icinga

CVE-2021-37698

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside from upgrading.

Vulnerability class: Improper Certificate Validation

Published 2021-08-19 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.014 (71.8th percentile), scored 2026-10-21.

Low probability of exploitation in the next 30 days, but still tracked. 72nd percentile — 71.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.014 · newest: 0.014 · change: -0.000

Affected products

Icinga
Icinga Icinga2 — versions >= 2.5.0, <= 2.13.0
Debian Linux — versions 9.0

Weakness classification (CWE)

CWE-295 — Improper Certificate Validation

References

github.com/Icinga/icinga2/security/advisories/GHSA-cxfm-8j5v-5qr2 (Third Party Advisory)
github.com/Icinga/icinga2/releases/tag/v2.11.11 (Third Party Advisory, Release Notes)
github.com/Icinga/icinga2/releases/tag/v2.12.6 (Third Party Advisory, Release Notes)
github.com/Icinga/icinga2/releases/tag/v2.13.1 (Third Party Advisory, Release Notes)
lists.debian.org/debian-lts-announce/2021/11/msg00010.html (mailing-list, Mailing List, Third Party Advisory)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2021-37698?: CVE-2021-37698 is a high-severity vulnerability in Icinga, classified under Improper Certificate Validation. CVSS score: 7.5/10. Published 2021-08-19.
How severe is CVE-2021-37698?: High severity. CVSS v3 base score is 7.5 out of 10.