Coordinated Vulnerability Disclosure Policy

Icinga supports the coordinated disclosure of vulnerabilities. If you have found a security issue in an Icinga product, this page tells you how to report it, what happens after you do, and what you can expect from us in return.

This policy describes the process through which vulnerabilities are reported to Icinga so that we can diagnose and remedy them before the details are made public. It applies to all software published by Icinga GmbH, including Icinga 2, Icinga Web, Icinga DB, Icinga Director, the Icinga modules and agents we maintain, and the web services we operate under icinga.com.

 

Scope

This policy covers vulnerabilities in:

  • Icinga products and components published by Icinga GmbH, including their releases and packages.
  • Third-party or open-source components integrated into an Icinga product, where the vulnerability affects the product as we ship it.
  • Web services operated by Icinga under icinga.com and its subdomains.

For bugs, feature requests, and general questions that are not security-related, please use the project’s issue tracker on GitHub or the community forum instead. We use the channels below only for security reports.

 

How to report a vulnerability

There are two ways to reach us. Both are monitored by the Icinga security team.

 

1. GitHub Private Vulnerability Reporting (recommended for a specific project)

For an issue in a specific project, GitHub is the fastest route. It keeps the report private and in the context of the source code.

  • Open the Security tab of the relevant Icinga repository on GitHub.
  • Select Report a vulnerability to open a private draft advisory.
  • Describe the issue, the steps to reproduce it, and the impact you observed.

 

2. Email, optionally encrypted with PGP

If you would rather not use GitHub, or the issue spans several projects or affects one of our web services, email the security team.

  • Email: security(at)icinga.com
  • PGP fingerprint: 4A7E 2D51 E626 E324 87E4 D9A7 AA5F 3BFF 899B 6DA5
  • Key ID: AA5F3BFF899B6DA5

You can download the public key from keys.openpgp.org by searching for the email address or the key ID. Encryption is optional but recommended for sensitive details.

This email address is our single point of contact for security matters. You can report in English or German, and you are not required to use automated tools to reach us.

 

Reporting anonymously or via a CSIRT

You do not have to report to us directly. Under the EU Cyber Resilience Act, you can report a vulnerability in an Icinga product to a CSIRT designated as a coordinator under Article 12(1) of Directive (EU) 2022/2555, including anonymously if you prefer. The coordinator will handle the exchange with us. Reporting directly to us is usually faster, but the choice is yours.

 

What to include

The more detail you provide, the faster we can confirm and fix the issue. Where possible, include:

  • The affected product and version.
  • A descriptive title and your assessment of the severity.
  • A proof-of-concept or clear steps to reproduce the behaviour.
  • The impact you observed or expect.
  • Any suggested mitigation or fix.

 

What happens next

Our process follows the practice described in ISO/IEC 29147 (vulnerability disclosure) and ISO/IEC 30111 (vulnerability handling). The typical steps:

  1. Acknowledgement. We confirm we have received your report, usually within a few working days.
  2. Triage. We reproduce the issue, assess its impact, and assign a severity, typically using CVSS. If we need more information, we will ask.
  3. Remediation. We develop and test a fix, or a mitigation where a full fix is not immediately possible. If the issue affects a third-party or open-source component, we report it to the maintainers of that component and, where we have developed a fix, share the relevant code or documentation with them.
  4. Coordinated disclosure. We agree a disclosure timeline with you and release the fix.

We will keep you informed as the work progresses. If we conclude that a report is not a vulnerability, we will explain why.

 

Disclosure and advisories

We ask that you give us a reasonable amount of time to fix the issue before publishing any details, so that users can update before the vulnerability becomes public. We coordinate the timing and the public communication with you.

Once a fix is available, we publish an advisory for the issue. Our advisories are released as GitHub Security Advisories (GHSA) on the affected repository and, where relevant, accompanied by a blog post at icinga.com/blog. Each advisory identifies the affected and fixed versions, describes the impact, gives a severity rating, and explains how to remediate. For vulnerabilities that warrant one, we request a CVE identifier through GitHub, which acts as a CVE Numbering Authority for projects it hosts, so that the issue has a stable public reference. Published CVEs affecting Icinga products can be found in the CVE List and the GitHub Advisory Database.

 

Support period and security updates

We handle vulnerabilities for the supported versions of each product throughout its support period. Security updates are provided through our official package repositories and release channels. Advisories tell you which versions contain the fix so you can identify whether your installation is affected and update accordingly.

 

Safe harbour

We value the work of security researchers and treat good-faith research as a contribution, not an attack. If you make a genuine effort to comply with this policy while investigating and reporting an issue, we will not pursue or support legal action against you for that research.

Good-faith research means, in particular, that you:

  • Report the issue to us promptly and give us reasonable time to respond before disclosing it to anyone else.
  • Only interact with accounts and systems you own or have explicit permission to test.
  • Avoid privacy violations, data destruction, service degradation, and any disruption to our users or infrastructure.
  • Do not access, modify, or retain more data than is necessary to demonstrate the issue, and delete any such data once it has been reported.

This safe harbour does not authorise activity that is unlawful in itself, and it does not extend to third parties whose systems or services you may reach through an Icinga product.

 

Recognition

We are glad to credit researchers in our advisories for the vulnerabilities they report, where they wish to be named. We do not currently run a paid bug bounty programme.