CVE-2026-9549
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Stored XSS in service discovery active check output in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 allows an admin to inject malicious HTML/JavaScript into check output.
Risk Assessment
Malicious script executes in the browser of an admin or user with host read permissions when running the check on the service discovery page, potentially leading to data theft or privilege escalation.
Recommendation
Update Checkmk to version 2.5.0p5, 2.4.0p31, 2.3.0p48, or later.
Other vulnerabilities in Checkmk
See all- CVE-2025-64998High
In Checkmk versions <2.4.0p23, <2.3.0p45, and 2.2.0, there is a vulnerability related to the exposure of the session signing secret. An administrator of a remote site with config sync enabled can hijack sessions on the central site by forging session cookies.
- CVE-2026-17548Medium
Missing authorization in Checkmk versions <2.5.0p12, <2.4.0p36, <2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results.
- CVE-2026-15576Medium
Improper authentication in the agent receiver of Checkmk before 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and availability. Only Cloud, Ultimate, and Ultimate MT editions are affected.
- CVE-2026-7485Low
An incorrect authorization vulnerability in frozen BI aggregations in Checkmk (versions <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0) allows an authenticated user with restricted host and service visibility to learn the names and existence of hosts and services they are not authorized to see.
- CVE-2026-15227Medium
Missing authorization in Checkmk before versions 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 (EOL) allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users.
- CVE-2026-8593Medium
Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules.
- CVE-2026-14852Medium
A privilege escalation vulnerability in Checkmk allows a local unprivileged user to execute arbitrary commands as root by starting a process crafted to look like a SAP HANA instance. The mk_sap_hana agent plugin, running as root, derives instance identifiers from the process list and uses them to build a command executed with elevated privileges.
- CVE-2026-8833Medium
Improper neutralization of HTML-encoded characters in URL validation in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 allows an authenticated user to bypass URL validation and inject malicious URLs like javascript: URIs, leading to XSS.
- CVE-2026-8078Medium
Stored XSS in global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 allows an admin to store malicious HTML/JavaScript in changelog messages.
- CVE-2026-7765Medium
Checkmk before version 2.5.0p5 has an incorrect authorization vulnerability in the User Messages dashboard widget. Message-fetching endpoints return the dashboard creator's messages instead of the viewer's, allowing an attacker with a valid public dashboard share token to read the issuer's personal messages.
Original NVD description (English source)
Stored cross-site scripting in the service discovery active check output in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can configure active or custom checks to inject malicious HTML or JavaScript into check output that executes in the browser of an admin or a user with host read permissions when they run the check on the service discovery page.