Threat Intelligence Database

Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.

Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in count queries to infer information about hosts and services outside their contact groups and occupying web server and Livestatus workers for an attacker-controlled duration.

CVE-2026-92882 is a vulnerability in Checkmk versions prior to certain patch levels that allows an authenticated user with permission to view host configurations to retrieve sensitive credentials such as SNMP community strings, SNMPv3 authentication and privacy passphrases, and IPMI passwords in clear text via the REST API. These credentials are not displayed in the setup GUI but are exposed in GET responses from the host and folder configuration endpoints.

Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an arbitrary size.

CVE-2026-17548 is a medium severity vulnerability in Checkmk versions prior to certain patch releases that allows an authenticated user with knowledge of a background job ID to view the status and results of that job due to missing authorization checks.

Checkmk versions prior to 2.5.0p10 contain an improper authentication vulnerability in the agent receiver component. This flaw allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification for relay endpoints by using a fixed placeholder identity in the request URL. The vulnerability affects only the Cloud, Ultimate, and Ultimate MT editions, as other editions do not expose relay endpoints. The impact is limited to integrity and availability. No known exploits are reported in the wild, and no official patch information is provided.

CVE-2026-15576 is a medium severity vulnerability in Checkmk versions 2.5.0 through 2.5.0p9. It involves improper authentication in the agent receiver component, allowing an unauthenticated remote attacker to bypass mutual TLS client certificate verification on relay endpoints by using a fixed placeholder identity in the request URL. This issue affects only the Cloud, Ultimate, and Ultimate MT editions of Checkmk, as other editions do not expose relay endpoints. The impact is limited to integrity and availability.

CVE-2026-7485 is an incorrect authorization vulnerability in Checkmk versions prior to certain patch levels. It affects frozen BI aggregations and allows an authenticated user with restricted host and service visibility to discover the names and existence of hosts and services they should not be authorized to see. The vulnerability has a low severity score and does not allow further privilege escalation or data modification.

CVE-2026-15227 is a medium severity vulnerability in Checkmk that allows an authenticated user without the 'Edit foreign Reports' permission to modify reports owned by other users. It affects Checkmk versions prior to 2.5.0p10, 2.4.0p35, and 2.3.0p49, as well as version 2.2.0 which is end-of-life. This is due to missing authorization checks in the affected versions.

Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules