CVE-2026-15576
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Improper authentication in the agent receiver of Checkmk before 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and availability. Only Cloud, Ultimate, and Ultimate MT editions are affected.
Risk Assessment
Risk of integrity and availability breaches in monitoring services, potentially leading to false data or outages.
Recommendation
Upgrade Checkmk to version 2.5.0p10 or later, which includes the fix.
Other vulnerabilities in Checkmk
See all- CVE-2025-64998High
In Checkmk versions <2.4.0p23, <2.3.0p45, and 2.2.0, there is a vulnerability related to the exposure of the session signing secret. An administrator of a remote site with config sync enabled can hijack sessions on the central site by forging session cookies.
- CVE-2026-17548Medium
Missing authorization in Checkmk versions <2.5.0p12, <2.4.0p36, <2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results.
- CVE-2026-7485Low
An incorrect authorization vulnerability in frozen BI aggregations in Checkmk (versions <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0) allows an authenticated user with restricted host and service visibility to learn the names and existence of hosts and services they are not authorized to see.
- CVE-2026-15227Medium
Missing authorization in Checkmk before versions 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 (EOL) allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users.
- CVE-2026-8593Medium
Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules.
- CVE-2026-14852Medium
A privilege escalation vulnerability in Checkmk allows a local unprivileged user to execute arbitrary commands as root by starting a process crafted to look like a SAP HANA instance. The mk_sap_hana agent plugin, running as root, derives instance identifiers from the process list and uses them to build a command executed with elevated privileges.
- CVE-2026-9549Medium
Stored XSS in service discovery active check output in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 allows an admin to inject malicious HTML/JavaScript into check output.
- CVE-2026-8833Medium
Improper neutralization of HTML-encoded characters in URL validation in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 allows an authenticated user to bypass URL validation and inject malicious URLs like javascript: URIs, leading to XSS.
- CVE-2026-8078Medium
Stored XSS in global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 allows an admin to store malicious HTML/JavaScript in changelog messages.
- CVE-2026-7765Medium
Checkmk before version 2.5.0p5 has an incorrect authorization vulnerability in the User Messages dashboard widget. Message-fetching endpoints return the dashboard creator's messages instead of the viewer's, allowing an attacker with a valid public dashboard share token to read the issuer's personal messages.
Original NVD description (English source)
Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and availability. Only the Cloud, Ultimate and Ultimate MT editions are affected, as other editions do not expose relay endpoints.