Is CVE-2021-32747 actively exploited?

No active exploitation of CVE-2021-32747 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2021-32747 be exploited remotely?

Yes. CVE-2021-32747 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2021-32747?

CVE-2021-32747 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2021-32747

MEDIUM

CVE-2021-32747

CWE-200Published: July 12, 2021· Updated: Jun 17, 2026

6.5

CVSS v3.1

Official Description

Icinga Web 2 is an open source monitoring web interface, framework, and command-line interface. A vulnerability in which custom variables are exposed to unauthorized users exists between versions 2.0.0 and 2.8.2. Custom variables are user-defined keys and values on configuration objects in Icinga 2. These are commonly used to reference secrets in other configurations such as check commands to be able to authenticate with a service being checked. Icinga Web 2 displays these custom variables to logged in users with access to said hosts or services. In order to protect the secrets from being visible to anyone, it's possible to setup protection rules and blacklists in a user's role. Protection rules result in `***` being shown instead of the original value, the key will remain. Backlists will hide a custom variable entirely from the user. Besides using the UI, custom variables can also be accessed differently by using an undocumented URL parameter. By adding a parameter to the affected routes, Icinga Web 2 will show these columns additionally in the respective list. This parameter is also respected when exporting to JSON or CSV. Protection rules and blacklists however have no effect in this case. Custom variables are shown as-is in the result. The issue has been fixed in the 2.9.0, 2.8.3, and 2.7.5 releases. As a workaround, one may set up a restriction to hide hosts and services with the custom variable in question.

NVD Source

Technical Analysis

CVE-2021-32747 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.5.

From a weakness classification perspective (CWE-200): Information exposure vulnerabilities leak sensitive data to unauthorized actors.