The vulnerability identified as CVE-2026-15576 involves a missing authentication mechanism in the agent receiver component of Checkmk version 2.5.0. An unauthenticated remote attacker can bypass mutual TLS client certificate verification by supplying a fixed placeholder identity in the request URL targeting relay endpoints. This flaw is limited to the Cloud, Ultimate, and Ultimate MT editions of Checkmk, as other editions do not expose relay endpoints. The issue results in a limited impact on the integrity and availability of the affected systems. The CVSS 4.0 base score is 6.9, reflecting a medium severity level. No official remediation or patch is currently documented, and no known exploits are reported in the wild.

An unauthenticated remote attacker can bypass mutual TLS client certificate verification on relay endpoints, potentially affecting the integrity and availability of the Checkmk system. The impact is limited and does not affect confidentiality or cause a complete denial of service. Only specific editions exposing relay endpoints are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to relay endpoints and monitor for unusual activity related to agent receiver requests. Consider disabling relay endpoints if not required.