CVE-2025-64998
HighSummary
In Checkmk versions <2.4.0p23, <2.3.0p45, and 2.2.0, there is a vulnerability related to the exposure of the session signing secret. An administrator of a remote site with config sync enabled can hijack sessions on the central site by forging session cookies.
Risk Assessment
The exposure of the session secret poses a risk of session hijacking by unauthorized users, potentially leading to unauthorized access to system data and functions.
Recommendation
It is recommended to update Checkmk to the latest version to mitigate this vulnerability and to monitor logs for potential session hijacking attempts.
Other vulnerabilities in Checkmk
See all- CVE-2026-17548Medium
Missing authorization in Checkmk versions <2.5.0p12, <2.4.0p36, <2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results.
- CVE-2026-15576Medium
Improper authentication in the agent receiver of Checkmk before 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and availability. Only Cloud, Ultimate, and Ultimate MT editions are affected.
- CVE-2026-7485Low
An incorrect authorization vulnerability in frozen BI aggregations in Checkmk (versions <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0) allows an authenticated user with restricted host and service visibility to learn the names and existence of hosts and services they are not authorized to see.
- CVE-2026-15227Medium
Missing authorization in Checkmk before versions 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 (EOL) allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users.
- CVE-2026-8593Medium
Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules.
- CVE-2026-14852Medium
A privilege escalation vulnerability in Checkmk allows a local unprivileged user to execute arbitrary commands as root by starting a process crafted to look like a SAP HANA instance. The mk_sap_hana agent plugin, running as root, derives instance identifiers from the process list and uses them to build a command executed with elevated privileges.
- CVE-2026-9549Medium
Stored XSS in service discovery active check output in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 allows an admin to inject malicious HTML/JavaScript into check output.
- CVE-2026-8833Medium
Improper neutralization of HTML-encoded characters in URL validation in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 allows an authenticated user to bypass URL validation and inject malicious URLs like javascript: URIs, leading to XSS.
- CVE-2026-8078Medium
Stored XSS in global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 allows an admin to store malicious HTML/JavaScript in changelog messages.
- CVE-2026-7765Medium
Checkmk before version 2.5.0p5 has an incorrect authorization vulnerability in the User Messages dashboard widget. Message-fetching endpoints return the dashboard creator's messages instead of the viewer's, allowing an attacker with a valid public dashboard share token to read the issuer's personal messages.
Original NVD description (English source)
Exposure of session signing secret in Checkmk <2.4.0p23, <2.3.0p45 and 2.2.0 allows an administrator of a remote site with config sync enabled to hijack sessions on the central site by forging session cookies.